Mosquitto: A TLS error occurred

[korish]

I'm constantly getting the "A TLS error occurred" message using the mosquitto_pub command from terminal on localhost.

The strange thing is that setting the same parameters in MQTT.fx GUI tool on localhost it works nice: i can connect, subscribe and publish messages. I have been struggling for 3 days already and hope someone can help or at least give some hints where to search for solution.

Here is my mosquitto config file (it's the only config file i have):

pid_file /var/run/mosquitto.pid
persistence true
persistence_location /var/lib/mosquitto/
log_dest file /var/log/mosquitto/mosquitto.log
log_timestamp true
log_type all
allow_anonymous false
password_file /etc/mosquitto/passwd
connection_messages true

port 8883
cafile /etc/mosquitto/ca_certificates/ca.crt
keyfile /etc/mosquitto/certs/mosquitto.key
certfile /etc/mosquitto/certs/mosquitto.crt

include_dir /etc/mosquitto/conf.d

And here is the command i use in terminal:
mosquitto_pub -h localhost -p 8883 --cafile /etc/mosquitto/ca_certificates/ca.crt -u user -P password -t "testing" -m "hello world" -d --insecure

The only difference i see between using MQTT.fx and mosquitto_pub from terminal is that in MQTT.fx user first clicks Connect button to establish connection with broker. I didn't find such command in mosquitto documentation to be able to use it from terminal.

Here is also some logs that can be useful as well:

1517780154: New connection from 127.0.0.1 on port 8883.
1517780154: OpenSSL Error: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
1517780154: OpenSSL Error: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure
1517780154: Socket error on client <unknown>, disconnecting.

[korish]

Update:
I've found out that the problem is in the generated keys and certificates. I tried to use certificates generated via script from this link and it worked.

I followed the instructions from here.

$ openssl req -new -x509 -days 1095 -extensions v3_ca -keyout ca.key -out ca.crt

$ openssl genrsa -out mosquitto.key 2048
$ openssl req -out mosquitto.csr -key mosquitto.key -new

$ openssl x509 -req -in mosquitto.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out mosquitto.crt -days 1095

Any ideas what can be wrong there?

[toast-uz]

I didn't try but maybe you can find the help in http://www.steves-internet-guide.com/mosquitto-tls/ . The link says that the official instruction in https://mosquitto.org/man/mosquitto-tls-7.html doesn't work on current openssl.

[JeffLabonte]

I have the same issue as korish except I don't have the handshake error.

I have tried it @toast-uz, unfortunatly it doesn't work. I am still getting the error from the mosquitto client and as well from my CPP code.

I remember that using the certificates generated from the paho-mqtt project for C/C++, I could make my TLS work like a charm. I have asked paho-mqtt project to provide me with their openssl command they have used, so I can try it on my machine and hopefully fix this problem I am having with TLS at the moment.

[korish]

@toast-uz Thanks for the links! After reading them again carefully i think i found the problem. I generated server and client keys with passwords. After using this script i managed to publish message without error.

One thing i would like to add. If you want to publish messages without using --insecure parameter you should set require_certificate is true in mosquitto configuration file providing client certificate and key as well.

I generated the client key and certificate by instructions from here. Read point 4 for more details:

$ openssl genrsa -out client.key 2048
$ openssl req -new -out client.csr \
  -key client.key -subj "/CN=client/O=example.com"
$ openssl x509 -req -in client.csr -CA ca.crt \
  -CAkey ca.key -CAserial ./ca.srl -out client.crt \
  -days 3650 -addtrust clientAuth

[toast-uz]

Closing as asking the setup procedure. Re-open if you are sure there is a bug, or ask at mosquitto-dev ML.

[fred3005]

Hello @korish,
I noticed that I had the same error and I noticed that you generated client key.
now can you please tell me how you configured your mosquitto.conf? and where you copied client.crt and client.key? Because I always get mistakes.
Thank you in advance.
Greetings Fred

[aomegax]

Hello,
I copied client.crt and client.key in mosquitto.conf as certfile and keyfile.

I have not understood why in the publish or subscribe requests in python I must specify ca.crt, client.crt and client.key. Why should I specify everything?
client.tls_set(ca_certs="ca.crt", certfile="client.crt", keyfile="client.key")

If I specify only ca.crt or other I have TLS error.