search

yllibed / Zigbee2MqttAssistant

GUI for Zigbee2Mqtt running in docker and HASS.IO
450 stars 42 forks source link

Specify trusted CA for MQTT broker / Implement certificates-pinning #251

Open koenvervloesem opened 4 years ago

koenvervloesem commented 4 years ago

Is your feature request related to a problem? Please describe. I have an MQTT broker with a TLS certificate signed by my own trusted CA. I can't connect to this MQTT broker with Zigbee2MqttAssistant because it doesn't trust the certificate:

Starting Zigbee2MqttAssistant v0.3.133+Branch.master.Sha.f490bd70a0401bc6d96a4d02d5f9022a43bb5e9e...
warn: Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository[60]
      Storing keys in a directory '/root/.aspnet/DataProtection-Keys' that may not be persisted outside of the container. Protected data will be unavailable when container is destroyed.                         
Hosting environment: Production
Content root path: /app
Now listening on: http://[::]:80
Application started. Press Ctrl+C to shut down.
warn: Zigbee2MqttAssistant.Services.MqttConnectionService[0]
      Unable to connect to MQTT server pi-red.home.
MQTTnet.Exceptions.MqttCommunicationException: The remote certificate is invalid according to the validation procedure.

Describe the solution you'd like I'd like to have an environment variable to set the CA certificate, so it will trust the certificate of my MQTT broker.

carldebilly commented 4 years ago

Are you using the HASS.IO version or just in Docker?

You can customize the image using a Dockerfile in the following way: https://stackoverflow.com/a/42292623/1176099

koenvervloesem commented 4 years ago

I'm using the Docker image carldebilly/zigbee2mqttassistant.

Thanks for the pointer about customizing Docker images to do this. For maintainability reasons I prefer to do this without having to customize your official Docker image, but it's an acceptable temporary workaround.

carldebilly commented 4 years ago

You can also deactivate the TLS certificate check to put in insecure mode.

koenvervloesem commented 4 years ago

I know, but I want to check it, that's one of my reasons to use TLS :-) I'll use your image customization workaround for now.

carldebilly commented 4 years ago

Maybe a kind of certificate pinning feature could be great for you. Let's say you put the TLS mode in insecure mode, but pin the CA certificate hash somewhere in the configuration...

How did you solve the problem with Z2M itself? ...and other dependencies (HA...)?

koenvervloesem commented 4 years ago

For now I have decided to run mosquitto on the same machine as Zigbee2mqtt and Zigbee2MqttAssistant so they can communicate unencrypted using the local Docker network. The plan is to bridge this MQTT broker to my main MQTT broker over TLS. That would solve the problem for me.