Mqtt.js: TLS / SSL connection cannot verify the certificate, when rejectUnauthorized is set to false

[ysfscream]

when I set rejectUnauthorized to false, I can create an authenticated connection, but in fact, no matter what CA file is passed, you can connect.

These are my codes:

const { ca, cert, key } = sslPath
const sslOptions: SSLContent = {
    ca: ca !== '' ? [fs.readFileSync(ca)] : undefined,
    cert: cert !== '' ? fs.readFileSync(cert) : undefined,
    key: key !== '' ? fs.readFileSync(key) : undefined,
    rejectUnauthorized: true,
 }

So I set rejectUnauthorized to the true, and always prompt me with this error message, I think there should be no problem with my CA file, because it works on MQTT.fx

Error:

Error [ERR_TLS_CERT_ALTNAME_INVALID]:
Hostname/IP does not match certificate's altnames: IP: 127.0.0.1 is not in the cert's list:

I appreciate it if you can help me!

[jdiamond]

You are connecting with an IP address? Node.js requires the IP address to be in the subjectAltNames for the cert and not in the CN. Maybe MQTT.fx isn't requiring that, but it should.

[ysfscream]

@jdiamond Oh, thank you for your reply! But what should I do? Is that a problem with my CA file certificate? Thanks again!

[jdiamond]

It's not a problem with your CA certificate, but with the server's. Those files are usually different unless you're using a self-signed certificate. If your server's certificate says CN=localhost in the Subject field, connect using localhost and not 127.0.0.1 and it should work. If it says CN=127.0.0.1, you have to make a new one because Node.js won't validate the IP address unless it's in the SAN extension. There is a way to work around it in code (I think it's an option called checkServerIdentity), but I would prefer to fix my certificate if I had this problem.

[YoDaMa]

looks like @jdiamond answered this.

[ysfscream]

@jdiamond Thank you so much, I think I know how to do it.