Emqx: emqttd 2.3.11 SSL Problem

[rootqa]

Environment:

• OS: Debian
• Erlang/OTP:
• EMQ: emqttd 2.3.11

Problem: SSL configuration error

Details:
we are using emqtt version 2.3.11 on Debian and we want to run WSS using SSL certifications.

Step 1: Create certificate

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout emqttd.key -out emqttd.crt

Step 2: Set SSL Listener and WSS

vi etc/emq.conf

listener.ssl.external.keyfile = /etc/ssl/emqtt/emqttd.key
listener.ssl.external.certfile = /etc/ssl/emqtt/emqttd.crt

listener.wss.external.keyfile = /etc/ssl/emqtt/emqttd.key
listener.wss.external.certfile = /etc/ssl/emqtt/emqttd.crt

vi etc/plugins/emq_dashboard.conf

dashboard.listener.https.keyfile = /etc/ssl/emqtt/emqttd.key
dashboard.listener.https.certfile = /etc/ssl/emqtt/emqttd.key

I'm getting the first problem crash error and second I know I using not verified certificate however INVALID in the log gives them I don't want the certificate to be verified. how to fix problems?

Log 1:

Dec 4 17:23:40 mqttd emqttd[6836]: [error] <0.1426.0> Supervisor 'esockd_connection_sup - <0.1426.0>' had child connection started with mochiweb_http:start_link({emq_dashboard,handle_request,[{state,"/opt/emqttd/lib/emq_dashboard-2.3.11/priv/www",#Fun exit with reason {ssl_error,{options,{keyfile,"opt/emqttd/ssl/emqtt.key",{error,enoent}}}} in esockd_connection:upgrade/1 line 131 in context connection_crashed

Log 2:

WebSocket connection to 'wss://localhost:8084/mqtt' failed: Error in connection establishment: net::ERR_CERT_AUTHORITY_INVALID

Thanks for all help!

[gilbertwong96]

Hi, @ozgursoft .First log indicates that emqttd could not read the file opt/emqttd/ssl/emqtt.key, you should configure the right path of the emqttd.key.

[rootqa]

Hi, @ozgursoft .First log indicates that emqttd could not read the file opt/emqttd/ssl/emqtt.key, you should configure the right path of the emqttd.key.

Hello @Gilbert-Wong thank you so much and this first problem was solved and the problem was correct by giving the correct key path. I'm still looking for the answer to second question sir haproxy is running and emqtt is installed on two servers and running as a cluster.

emqtt1: 10.10.10.5
emqtt2: 10.10.10.6
haproxy: 10.10.10.7

So all requests passing through haproxy so should this certificate install on haproxy? for as wss work.

[zhengyupan]

Hi @ozgursoft , since you have an HAProxy in place, I will suggest that you terminate the TLS/SSL on HAproxy and let the EMQ focus on MQTT processing. This will also simplify the certificate management.