Open reubenmiller opened 1 year ago
The exact solution is unclear
I would go with better documentation, because auto-detection might be an end-less pursuit. You provided a clear statement of the issue. The doc can be simpler and focus on guidance. Say:
c8y.root_cert_path
is the path to the file containing the c8y signing certificate (possibly along other root certificates)./etc/ssl/certs
, then c8y.root_cert_path
can be set to this directory, letting the system figure out which one to use. There are two caveats though. Be sure to run openssl rehash
if you add a certificate. And be sure the C8Y signing certificate is not grouped with others in a single file as such files are ignored by mosquitto. If this is the case, you have to set c8y.root_cert_path
pointing to the file and not the directory.
Is your feature improvement request related to a problem? Please describe.
Improve guidance to users for setting the correct
c8y.root_cert_path
path (e.g. either a file or directory) to ensure thin-edge.io is able to connect to the intended Cumulocity instance via HTTPS and MQTT.The mosquitto settings which are created when running
tedge connect c8y
, the mosquitto ca setting is dependent on whether thec8y.root_cert_path
is set to a directory or a file. The table shows how the tedge settings are converted to the following mosquitto settings:However the problem arises when the default directory (
/etc/ssl/certs
) is used, and when it only contains a single file/etc/ss/certs/ca-certificates.crt
with multiple certificates concatenated inside it, then mosquitto ignores the file entirely and the bridge connection will fail with the follow errors:Diving into the mosquitto configuration manual, it clearly states that when using the
bridge_capath
setting, then the user must run the openssl command,openssl rehash <path to bridge_capath>
, however this command ignores files which contain more than 1 cert, so again the user is left confused/overwhelmed about how to get the cloud connection working.Below is the snippet from the mosquitto conf docs detailing about the rehash action.
Then finally after debugging the mosquitto logs and simple trial and error, the user might discover that using a ca file path works instead of a directory, and they update the setting in thin-edge using the following command:
Describe the solution you'd like
The exact solution is unclear, however the solution should aim at reducing the amount of configuration for users that are not familiar with the ca settings, and nuances of different linux distributions.
But some solutions could include:
c8y.root_cert_path
default setting based on the contents of the/etc/ssl/certs
folder, e.g./etc/ssl/certs/
if the directory exists and contains more than 1 certificate/etc/ssl/certs/ca-certifications
if the file exists, and it is the only cert file in the/etc/ssl/certs
directoryDescribe alternatives you've considered
Additional context