Getting error message when I use SSL on my server running Mosquitto?

Question

I have implemented the mosquitto broker for ubuntu on port 8883 and port 1883 and can't figure out why I keep getting the CA related errors shown below.

It happens when I test it using mosquitto_pub locally on the server and when I use the Paho/Python script as the client on my MacBook. My mosquitto.config file, mosquitto_pub command, and my mosquitto log messages are shown below. I've also included my openssl certificate creation commands in case I did something wrong.

This is my mosquitto.conf file

# Place your local configuration in /etc/mosquitto/conf.d/
# A full description of the configuration file is at
# /usr/share/doc/mosquitto/examples/mosquitto.conf.example

pid_file /var/run/mosquitto.pid

persistence true
persistence_location /var/lib/mosquitto/

#log_dest file /var/log/mosquitto/mosquitto.log
log_dest stdout

include_dir /etc/mosquitto/conf.d

log_type all

#-----------------------------------------------
#Default Listener
#-----------------------------------------------

port 8883

#------------------------------------------------
#Certificate Based SSL/TLS Support
#------------------------------------------------

cafile /../etc/mosquitto/ca_certificates/ca.crt
keyfile /../etc/mosquitto/certs/server.key
certfile /../etc/mosquitto/certs/server.crt

listener 1883

This is the mosquitto_pub command I use to test it.

sudo mosquitto_pub -h 305.875.987.34 -t test -m "Typing this" -p 8883 --cafile /../etc/mosquitto/ca_certificates/ca.crt

This is what the mosquitto log says when I run it.

1546507891: mosquitto version 1.5.5 starting
1546507891: Config loaded from /../etc/mosquitto/mosquitto.conf.
1546507891: Opening ipv4 listen socket on port 1883.
1546507891: Opening ipv6 listen socket on port 1883.
1546507891: Opening ipv4 listen socket on port 8883.
1546507891: Opening ipv6 listen socket on port 8883.
1546507929: New connection from 305.875.987.34 on port 8883.
1546507929: OpenSSL Error: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
1546507929: Socket error on client <unknown>, disconnecting.

These are the openssl commands I used to create ca.crt, server.crt, and server.key. I created them in a folder called certs.

openssl genrsa -des3 -out ca.key 2048
openssl req -new -x509 -days 1826 -key ca.key -out ca.crt
openssl genrsa -out server.key 2048
openssl req -new -out server.csr -key server.key
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 360

I then moved ca.crt to /../etc/mosquitto/ca_certifications after deleting an old ca.crt I had made trying to fix the problem. I did this with the following two commands.

sudo rm /../etc/mosquitto/ca_certifications/ca.crt
sudo mv ca.crt /../etc/mosquitto/ca_certifications

I did the same thing with server.crt and server.key except I put them in /../etc/mosquitto/certs.

The broker seems to work fine on port 1883.

Let me know if you need any more info.

Self created cert -> No known CA. The error seems logical to me. Dont know if mosquito can be configured to ignore CA validation or admite self-signed certs. — Cleptus

hardillb hardillb · Accepted Answer · 2019-01-03T14:12:19

To start with I would rearrange your mosquitto.conf to make things more obvious what is linked to what and to remove the relative paths to your certs/key files as follows:

# Place your local configuration in /etc/mosquitto/conf.d/
# A full description of the configuration file is at
# /usr/share/doc/mosquitto/examples/mosquitto.conf.example

pid_file /var/run/mosquitto.pid

persistence true
persistence_location /var/lib/mosquitto/

#log_dest file /var/log/mosquitto/mosquitto.log
log_dest stdout

include_dir /etc/mosquitto/conf.d

log_type all

#-----------------------------------------------
#Default Listener
#-----------------------------------------------

port 1883

#------------------------------------------------
#Certificate Based SSL/TLS Support
#------------------------------------------------
listener 8883
cafile /etc/mosquitto/ca_certificates/ca.crt
keyfile /etc/mosquitto/certs/server.key
certfile /etc/mosquitto/certs/server.crt

I've swapped the port/listener entries to make it obvious that the SSL setup is bound to the port 8883 listener. I've also removed the /../ from the start of the paths as this is meaningless as it's impossible to go "up" a directory from the / "root".

Likewise you should use the direct paths for the mosquitto_pub command.

Also as you are copying files around as root (with sudo), make sure that the cert/key files are readable by the mosquitto user.

Getting error message when I use SSL on my server running Mosquitto?

1 Answers