using mosquitto_sub with --insecure

Question

Right now I have to do an initial test of a mqtt broker (ssl). However right now I don't have the valid truststore certificates, however I would like to test the basic connectivity, ignoring SSL errors regarding hostname verification, certificate validation etc.

Unfortunately I am not successful, even with a broker I know it's working.

What I'm doing:

mosquitto_sub -h the_host -p 8883 -t '#' -v -u myUser -P myPass --insecure -d --capath /etc/ssl/certs

According to the manpage I just use the --capath to identify it's a TLS connection, well knowing that the necessary root certificate is not available here.

What I get is this:

Client mosqsub|11262-csbox sending CONNECT
Error: A TLS error occurred.

Any idea what I'm doing wrong?

Answer 1

Using --insecure just disables the verification of the hostname in the certificate presented by the broker. It does not remove the need to have a copy of the CA certificate that signed the brokers certificate.

So if /etc/ssl/certs doesn't contain a matching CA certificate then the connection will fail.

If needed you should be able to use something like openssl s_client to download the certificate chain directly from the broker, you can then point to that file with the --cafile option instead of the --capath option.