search

eclipse / mosquitto

Eclipse Mosquitto - An open source MQTT broker
https://mosquitto.org
Other
8.89k stars 2.36k forks source link

TLS certificate instructions no longer work #1339

Open slimjim777 opened 5 years ago

slimjim777 commented 5 years ago

The mosquitto docs have a great run-through for setting up X509 certificates for mosquitto (https://mosquitto.org/man/mosquitto-tls-7.html), but these no longer work with the latest versions of mosquitto. In testing, I've found script that does generate valid certificates (https://github.com/owntracks/tools/blob/master/TLS/generate-CA.sh) and it generates X509v3 certificates with some additional options (rather than x509v1 certificates).

I'm no expert in openssl, but I've whittled down the generation to this for my own purposes. But I think the docs need updating.

ralight commented 5 years ago

I think you're being generous to say they are a great run through, they are bare bones commands with no other guidance.

They do work with current versions though, I'm curious what you are seeing that doesn't work?

I agree that the owntracks script is excellent!

slimjim777 commented 5 years ago

They do work with current versions though, I'm curious what you are seeing that doesn't work?

I found that the client device was not able to connect to the MQTT server. The error message was quite generic, though I don't have a record of it now. I think that the own tracks approach specifies the use of each certificate and that seems to be needed now.