SSL not working / environment variable not set correctly

[Tost69]

Hi Cniweb,

first: thanks a lot for your work on contributing this openHAB Syno package.

I've installed the latest package (2.3.0.005) on my Synology NAS and it's working so far.

But I run into some trouble as soon as I installed the embedded MQTT broker (misc-mqttbroker - 2.3.0). I've choosen to secure the connection by SSL but that's not working right now. I've had some looks into the logs and found:

[INFO ] [.moquette.server.netty.NettyAcceptor] - Configuring Websocket MQTT transport [INFO ] [.moquette.server.netty.NettyAcceptor] - Property websocket_port has been setted to disabled. Websocket MQTT will be disabled [INFO ] [ver.DefaultMoquetteSslContextCreator] - Checking SSL configuration properties... [INFO ] [ver.DefaultMoquetteSslContextCreator] - Initializing SSL context. KeystorePath = null. [WARN ] [ver.DefaultMoquetteSslContextCreator] - The keystore path is null or empty. The SSL context won't be initialized. [ERROR] [.moquette.server.netty.NettyAcceptor] - Can't initialize SSLHandler layer! Exiting, check your configuration of jks

I interpret the message that something is wrong with the JKS keystore and checked that the keystore (/userdata/etc/keystore) was created correctly. Yes it is and it's used for securing openhab on port 8443 (this works well, so it's not a general SSL issue).

After this I checked jetty.xml in runtime/etc (it's different to jetty.xml in userdata/etc) and found that an environment variable is used to find the keystore. The setting comes from file custom.system.properties:

jetty.keystore.path=${openhab.userdata}/etc/keystore jetty.truststore.path=${openhab.userdata}/etc/keystore

So this settings seemed to be correct.

After checking the environment variables in Karaf it was clear that the passed path is too long. The string variables passed from custom.system.settings are shortened to a maximum length of 45 characters (instead of /volume1/@appstore/openHAB/userdata/etc/keystore its only /volume1/@appstore/openHAB/userdata/etc/keyst).

I've tried several things to find a way around this issue, but nothing really worked (e.g. copied the keystore file to keyst) and as the whole topic is new to me and I'm not that openHAB / Synology / Java expert I stopped at this point. I won't change configuration parameters / file locations / file names on suspicion to avoid my installation will get useless because I'm not knowing enough.

Maybe you have a solution/idea/hint for me? I also wonder if some other extensions (bindings/services/addons) will fail by this shortened setting? I'm also not sure if this is a Synology topic, a general Java topic or if the shortening of the variable content is caused by a too short variable declaration within the openHAB repository.

Any help is very appreciated, kind regards, Tom

[pieterzen]

I think it's more related to Jetty, as there are no settings like that in this package. Have you tried posting/searching on the openhab forum? Alternatively you could experiment with docker images; that way you won't be harming your own environment (if your syno supports it...).

[Tost69]

Hi Pieterzen,

thanks for your reply.

Meanwhile I checked several environment variables with the echo command and ... content is there. So while it's strange that the set is not working correctly (for other variables the set command shows a trailing '...' if the output is shortened) it cannot be the cause of the issue.

Something is wrong with the jetty configuration. I have a jetty.xml within runtime/etc with a section of extra options in it (including the path to the keystore) and another jetty.xml within userdata/etc without these options. However a keystore was created by the installation process and it's working for Karaf and openHAB at ports 8080/8443. My next step is to adapt /userdata/etc/jetty.xml.

I've added a comment to the github openHAB issue section, there is a related topic. Maybe it's working with openHAB 2.4? As far as I can see there were a lot of changes/bugfixes regarding MQTT and also an updated Karaf is used now.

Kind regards, Tom

[cniweb]

@Tost69 Is this issue with the new version fixed?

[Tost69]

@cniweb

I've got the embedded MQTT broker running with version 2.4, but have had no luck to secure the broker. SSL still isn't working for MQTT. I followed several tutorials to set this up correctly (including to put my own certificate and tried differend places for the keystore) without success. I hope this will be easier with one of the next versions.

For the time being, I am more involved in hardware development (sensors, etc.). Grafana + Influx-DB will also not be that easy to install on the Syno, so it might be easier to use Docker for it.

OT: I've run also in some trouble with installing ImageMagick for my Nextcloud installation. Image Magick itself is easy to get running, but to tell PHP to use it is a mess on the Syno NAS because there isn't a useful up to date linux standard package management. At this point, the question for me is whether it really makes sense to use a NAS for this type of server tasks.

Thanks a lot for your work again and kind regards, Tom