Getting error message when I use SSL on my server running Mosquitto?

Internet of Things IoT Frameworks . 2 years ago

  0   1   0   0   0 tuteeHUB earn credit +10 pts

5 Star Rating 5 Rating
_x000D_ _x000D_ I have implemented the mosquitto broker for ubuntu on port 8883 and port 1883 and can't figure out why I keep getting the CA related errors shown below. It happens when I test it using mosquitto_pub locally on the server and when I use the Paho/Python script as the client on my MacBook. My mosquitto.config file, mosquitto_pub command, and my mosquitto log messages are shown below. I've also included my openssl certificate creation commands in case I did something wrong. This is my mosquitto.conf file # Place your local configuration in /etc/mosquitto/conf.d/ # A full description of the configuration file is at # /usr/share/doc/mosquitto/examples/mosquitto.conf.example pid_file /var/run/mosquitto.pid persistence true persistence_location /var/lib/mosquitto/ #log_dest file /var/log/mosquitto/mosquitto.log log_dest stdout include_dir /etc/mosquitto/conf.d log_type all #----------------------------------------------- #Default Listener #----------------------------------------------- port 8883 #------------------------------------------------ #Certificate Based SSL/TLS Support #------------------------------------------------ cafile /../etc/mosquitto/ca_certificates/ca.crt keyfile /../etc/mosquitto/certs/server.key certfile /../etc/mosquitto/certs/server.crt listener 1883 This is the mosquitto_pub command I use to test it. sudo mosquitto_pub -h 305.875.987.34 -t test -m "Typing this" -p 8883 --cafile /../etc/mosquitto/ca_certificates/ca.crt This is what the mosquitto log says when I run it. 1546507891: mosquitto version 1.5.5 starting 1546507891: Config loaded from /../etc/mosquitto/mosquitto.conf. 1546507891: Opening ipv4 listen socket on port 1883. 1546507891: Opening ipv6 listen socket on port 1883. 1546507891: Opening ipv4 listen socket on port 8883. 1546507891: Opening ipv6 listen socket on port 8883. 1546507929: New connection from 305.875.987.34 on port 8883. 1546507929: OpenSSL Error: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca 1546507929: Socket error on client , disconnecting. These are the openssl commands I used to create ca.crt, server.crt, and server.key. I created them in a folder called certs. openssl genrsa -des3 -out ca.key 2048 openssl req -new -x509 -days 1826 -key ca.key -out ca.crt openssl genrsa -out server.key 2048 openssl req -new -out server.csr -key server.key openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 360 I then moved ca.crt to /../etc/mosquitto/ca_certifications after deleting an old ca.crt I had made trying to fix the problem. I did this with the following two commands. sudo rm /../etc/mosquitto/ca_certifications/ca.crt sudo mv ca.crt /../etc/mosquitto/ca_certifications I did the same thing with server.crt and server.key except I put them in /../etc/mosquitto/certs. The broker seems to work fine on port 1883. Let me know if you need any more info.

Posted on 16 Aug 2022, this text provides information on IoT Frameworks related to Internet of Things. Please note that while accuracy is prioritized, the data presented might not be entirely correct or up-to-date. This information is offered for general knowledge and informational purposes only, and should not be considered as a substitute for professional advice.

Take Quiz To Earn Credits!

Turn Your Knowledge into Earnings.

tuteehub_quiz

Write Your Comments or Explanations to Help Others



Tuteehub forum answer Answers (1)


profilepic.png
manpreet Tuteehub forum best answer Best Answer 2 years ago
_x000D_ To start with I would rearrange your mosquitto.conf to make things more obvious what is linked to what and to remove the relative paths to your certs/key files as follows: # Place your local configuration in /etc/mosquitto/conf.d/ # A full description of the configuration file is at # /usr/share/doc/mosquitto/examples/mosquitto.conf.example pid_file /var/run/mosquitto.pid persistence true persistence_location /var/lib/mosquitto/ #log_dest file /var/log/mosquitto/mosquitto.log log_dest stdout include_dir /etc/mosquitto/conf.d log_type all #----------------------------------------------- #Default Listener #----------------------------------------------- port 1883 #------------------------------------------------ #Certificate Based SSL/TLS Support #------------------------------------------------ listener 8883 cafile /etc/mosquitto/ca_certificates/ca.crt keyfile /etc/mosquitto/certs/server.key certfile /etc/mosquitto/certs/server.crt I've swapped the port/listener entries to make it obvious that the SSL setup is bound to the port 8883 listener. I've also removed the /../ from the start of the paths as this is meaningless as it's impossible to go "up" a directory from the / "root". Likewise you should use the direct paths for the mosquitto_pub command. Also as you are copying files around as root (with sudo), make sure that the cert/key files are readable by the mosquitto user.
0 views   0 shares

No matter what stage you're at in your education or career, TuteeHub will help you reach the next level that you're aiming for. Simply,Choose a subject/topic and get started in self-paced practice sessions to improve your knowledge and scores.

Important Internet of Things Links

tuteehub community

Join Our Community Today

Ready to take your education and career to the next level? Register today and join our growing community of learners and professionals.

tuteehub community