SSL/TLS with Eclipse Paho JavaScript Client

0
votes

I've got a JavaScript-based WebApp that includes the Eclipse Paho client.

The WebApp is stored and executed on an NGINX webserver. On the same Server where the webserver is installed, the MQTT broker mosquitto is running. I've defined port 8884 as listener port for secured connections.

Running mosquitto_sub (simple C client) with --cafile and -p 8884 works fine!

Now I want to secure the WebApp using SSL by passing mqttOptions = { useSSL: true } in my MQTT client implementation.

I can see that the app is trying to establish an connection to wss://ip instead of ws://ip. But the server responds with a connection refused which is totally clear because I did not configure anything on the webserver as I do not have a clue how to manage this. Will the wss connection be 'mapped' to a https or something? Do I need a websocket proxy in NGINX? Thanks in advance for any help.

2
sslnginxwebsocketmosquitto
sorry, the error is not "connection refused" but "WebSocket connection to 'wss://ip' failed: WebSocket opening handshake was canceled" - marrrschine

2 Answers

1
votes

You can not use the same port for raw MQTT and MQTT over websockets with mosquitto, you need to create 2 separate listeners.

The fact that you can connect with mosquitto_sub implies you have only set up a listener with the raw MQTT.

e.g.

listener 8883

listener 8884
protocol websockets

This will create a native MQTT listener on 8883 and a MQTT over websockets on port 8884

1
votes

I did so. Here is the mosquitto conf entry:

listener 8884 127.0.0.1
protocol websockets
cafile /path/to/ca.crt
certfile /path/to/certfile.crt
keyfile /path/to/keyfile.key
require_certificate false

and so the app is trying to connect to myip:8884