Error SSL/TLS connection in MQTT with mosquitto broker

Question

I am trying to use a SSL/TLS encryption connection with openssl between a raspberry and the mosquitto broker. To do so, I have entered the following commands:

openssl genrsa -des3 -out ca.key 2048
openssl req -new -x509 -days 2000 -key ca.key -out ca.crt
openssl genrsa -out server.key 2048
openssl req -new -out server.csr -key server.key
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 410

Then I have move the ca_certificates folder under /etc/mosquitto/ca_certificates and also the server certificate and key in the /etc/mosquitto/certs folder.

Now, I try to mosquitto -c mosquitto.conf -v it gives me:

1653586436: The 'port' option is now deprecated and will be removed in a future version. Please use 'listener' instead.
1653586436: mosquitto version 2.0.12 starting
1653586436: Config loaded from mosquitto.conf.
1653586436: Opening ipv4 listen socket on port 8883.
1653586436: Opening ipv6 listen socket on port 8883.
1653586436: Error: Unable to load CA certificates. Check cafile "c:\etc\mosquitto\ca_certificates\ca.crt".
1653586436: Error: Unable to load server certificate "c:\etc\mosquitto\certs\server.crt". Check certfile.
1653586436: OpenSSL Error[0]: error:02001002:system library:fopen:No such file or directory
1653586436: OpenSSL Error[1]: error:20074002:BIO routines:file_ctrl:system lib
1653586436: OpenSSL Error[2]: error:140DC002:SSL routines:use_certificate_chain_file:system lib

What I have in the mosquitto.conf is:

port 8883
cafile c:\etc\mosquitto\ca_certificates\ca.crt
certfile c:\etc\mosquitto\certs\server.crt
keyfile c:\etc\mosquitto\certs\server.key

Do you have any idea of where is my error?

Answer 1

mosquitto_pub 's default port is 1883, you have configured mosquitto to use port 8883

The correct command line is

mosquitto_pub --cafile ca.crt -h localhost -p 8883 -t Value -m 2

As it is this isn't even getting to any SSL stuff

Answer 2

I just solved the issue.The problem was that mosquitto was not capable of reading the files not because of permission issues but because of the filepaths.

So the thing was that when defining the filepaths in the mosquitto.conf I had to use:

cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key

Instead of:

cafile c:\etc\mosquitto\ca_certificates\ca.crt
certfile c:\etc\mosquitto\certs\server.crt
keyfile c:\etc\mosquitto\certs\server.key