How to use TLS connection with this plugin? about emqx-auth-mysql

[wwhai]

Can you try only use CA file?

[wwhai]

Hello.

I tried to connect via TLS connection (two way), and i got error:

2021-01-22 03:10:09.150 [error] <<"mosq-8uSquVlIsFP0oF0bHq">>@10.77.1.1:60320 [Hooks] Failed to execute {fun emqx_auth_mysql:check/3,[#{auth_query => {"select password from mqtt_user where username = ? limit 1",["'%C'"]},hash_type => md5,pool => emqx_auth_mysql,super_query => {"select is_superuser from mqtt_user where username = ? limit 1",["'%C'"]}}]}: {badarg,[{erlang,iolist_to_binary,[undefined],[]},{crypto,hash,2,[{file,"crypto.erl"},{line,604}]},{emqx_passwd,hash,2,[{file,"emqx_passwd.erl"},{line,59}]},{emqx_passwd,check_pass,2,[{file,"emqx_passwd.erl"},{line,41}]},{emqx_auth_mysql,check_pass,2,[{file,"emqx_auth_mysql.erl"},{line,85}]},{emqx_auth_mysql,check,3,[{file,"emqx_auth_mysql.erl"},{line,43}]},{emqx_hooks,safe_execute,2,[{file,"emqx_hooks.erl"},{line,164}]},{emqx_hooks,do_run_fold,3,[{file,"emqx_hooks.erl"},{line,143}]}]}
2021-01-22 03:10:09.151 [warning] <<"mosq-8uSquVlIsFP0oF0bHq">>@10.77.1.1:60320 [Channel] Client mosq-8uSquVlIsFP0oF0bHq (Username: 'undefined') login failed for not_authorized

My MySQL config is:

auth.mysql.auth_query = select password from mqtt_user where username = '%C' limit 1
auth.mysql.password_hash = md5
auth.mysql.super_query = select is_superuser from mqtt_user where username = '%C' limit 1
auth.mysql.acl_query = select allow, ipaddr, username, clientid, access, topic from mqtt_acl where ipaddr = '%a' or username = '%u' or username = '$all' or clientid = '%c' or clientid = '$all'

auth.mysql.ssl = on
auth.mysql.ssl.cafile  = root.pem
auth.mysql.ssl.certfile = server.pem
auth.mysql.ssl.keyfile = server.key

If i change %C to %us, connecting via username+password => it's ok.
But via TLS i got error. I don't have password for TLS certs, what should i do in this situation?
Should i use auth.mysql.* section?

I need to connect via TLS without password, using only root.pem -> client.pem -> client.key files.

If i allow anonymous - it's ok.

Help me, please. The intenet has information only for usersname+password connection.

Hi, have you resolved this? I will close this issue if you did it.