Skip to content

MQTT: Support OS provided CA certificates #1658

@der-dag

Description

@der-dag

Description

Ebusd should provide the option to use OS provided CA certificates for TLS connection to MQTT broker. I have a MQTT broker running that has hostname with a let's encrypt signed certificate so my MQTT clients can use OS provided CA to verify broker's certificate.

Currently if I try to connect ebusd to my MQTT Broker without providing a CA certificate ebusd cannot connect and the broker gives the error:

Client connection from 172.17.0.1 failed: error:0A00010B:SSL routines::wrong version number.

All the Mosquitto clients like mosquitto_sub and mosquitto_pub are providing this option and they are connecting fine with my MQTT broker. Implementation there looks like this:

if(cfg->cafile || cfg->capath){
		rc = mosquitto_tls_set(mosq, cfg->cafile, cfg->capath, cfg->certfile, cfg->keyfile, NULL);
		if(rc){
			if(rc == MOSQ_ERR_INVAL){
				err_printf(cfg, "Error: Problem setting TLS options: File not found.\n");
			}else{
				err_printf(cfg, "Error: Problem setting TLS options: %s.\n", mosquitto_strerror(rc));
			}
			mosquitto_lib_cleanup();
			return 1;
		}
#  ifdef FINAL_WITH_TLS_PSK
	}else if(cfg->psk){
		if(mosquitto_tls_psk_set(mosq, cfg->psk, cfg->psk_identity, NULL)){
			err_printf(cfg, "Error: Problem setting TLS-PSK options.\n");
			mosquitto_lib_cleanup();
			return 1;
		}
#  endif
	}else if(cfg->port == 8883){
		mosquitto_int_option(mosq, MOSQ_OPT_TLS_USE_OS_CERTS, 1);
	}
	if(cfg->tls_use_os_certs){
		mosquitto_int_option(mosq, MOSQ_OPT_TLS_USE_OS_CERTS, 1);
	}

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions