Feature Request: MQTT with client certificate about trigger

[Martinius]

I have just pulled the repo 5 minutes ago :) I will try my best but make sure to check it when I submit it. I am not exactly a Java expert.

[mwarning]

I was able to create certificates and connect with the MQTT-Explorer. Next up is Trigger.

[Martinius]

Do you need more help for the release?

[mwarning]

hi @Martinius, the example uses Bouncycastle as provider, which Trigger does not use. I am not a certifcate expert and do not know how to adapt the example. Feel free to submit a patch though.

[Martinius]

I have created a pull request.

Merry Christmas

[mwarning]

Thank you very much! :-)

I had to refactor the code to have a proper settings UI for the MQTT client key. That took longer than expected.
Let's see when I get my mosquitto setup running to test the current MQTT code. Then I can finally do a release.

[mwarning]

sure. The problem for me is to recreate/verfiy your MQTT code. Maybe I have broken it.

[mwarning]

Currently I get SSLHandshakeException: No subjAltNames on certificate match. I created the certificates according to https://www.onetransistor.eu/2019/05/mosquitto-mqtt-tls-certificate.html
mosquitto outputs:

1645986060: New connection from 192.168.1.182:51945 on port 8883.
1645986060: OpenSSL Error[0]: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown
1645986060: Client <unknown> disconnected: Protocol error.

"MQTT Explorer" with the same settings does work.

[mwarning]

It works when I disable hostname verification (opts.setHttpsHostnameVerificationEnabled(false)). Maybe the problem is that the address provided to MqttClient is ssl://mqtt-broker.lan:8883

[Martinius]

Yes I had the same problem. That is why I used a different way to create the certificates and CA. I used this script:
https://github.com/owntracks/tools/blob/master/TLS/generate-CA.sh

And adjusted the IPLIST and HOSTLIST parameters. I justed used the onetransistor.eu resource to setup the broker.

Best regards

[mwarning]

So far I am unsuccessful to create working server and client credentials. I tried generate-CA.sh this way:

export IPLIST="192.168.1.200"
export HOSTLIST="mqtt-broker.lan"
./generate-CA.sh
./generate-CA.sh client

(mqtt-broker.lan resolves to 192.168.1.200 and is my laptop and where mosquitto runs.)

This gives me the following files:

ca.crt  ca.key  ca.srl  client.crt  client.csr  client.key  laptop.crt  laptop.csr  laptop.key

/etc/mosquitto/mosquitto.conf has these lines:

listener 8883
cafile /etc/mosquitto/ca.crt
certfile /etc/mosquitto/laptop.crt
keyfile /etc/mosquitto/laptop.key
require_certificate true
use_identity_as_username true

For Trigger I then use ca.crt, client.crt and client.key. But this still fails with OpenSSL Error[0]: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed.

@Martinius Does this scheme match your setup?

[Martinius]

It seems to match my setup:

My complete server config is:

#Global
per_listener_settings true


#Certificate listener
listener 8883
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/basestation.crt
keyfile /etc/mosquitto/certs/basestation.key
require_certificate true


#Security
allow_anonymous false
password_file /etc/mosquitto/passwords.txt

autosave_interval 30
persistence_file mosquitto.db

persistence true
persistence_location /etc/mosquitto/data

Can you still connect via MQTT Explorer?

[mwarning]

MQTT Explorer disconnects with the certificates generated by generate-CA.sh. Mosquitto outputs 1646081753: OpenSSL Error[0]: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed

It would be nice to have some working instructions on generating certificates.

[Martinius]

I think I spotted the problem ;)
You have to use the script like this:

./generate-Ca.sh
./generate-Ca.sh server
./generate-Ca.sh client client1

Sorry for the fustration

[mwarning]

That finally worked. Thank you. But the procedure is a bit messy.

What I did:

export IPLIST="192.168.1.200"
export HOSTLIST="mqtt-broker.lan"
./generate-CA.sh
./generate-CA.sh server
./generate-CA.sh client client1

That generates the following files:

ca.crt  ca.key  ca.srl  client1.crt  client1.csr  client1.key   server.crt  server.csr  server.key  laptop.crt  laptop.csr  laptop.key

ca.crt, server.crt and server.key for mosquitto.
ca.crt, client1.crt and client1.key for Trigger.