Use mTLS with MQTTS

[fred-gb]

Bonjour 👋🏻

How to use mTLS certs with MQTTS?

I use apprise with borgmatic (docker).

apprise: 
  services: 
    - url: mqtts://mqtt.domain.tld:8883/topic?cafile=/etc/ssl/mosquitto/ca.pem&cert=/etc/ssl/mosquitto/domain.tld-backup.pem&key=/etc/ssl/mosquitto/domain.tld-backup.key 
  label: mqtts

I got this error:

Exception: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1081)

When I try:

apprise -vv \
  -b "TEST" \
  "mqtts://mqtt.domain.tld:8883/TOPIC?ca_certs=/etc/ssl/mosquitto/ca.pem&cert=/etc/ssl/mosquitto/cert.pem&key=/etc/ssl/mosquitto/cert.key"

Error:

WARNING - MQTT SSL Certificate Error received from mqtt.domain.tld:8883

On MQTT server (mosquitto on docker) this log:

1767520601: OpenSSL Error[0]: error:0A000418:SSL routines::tlsv1 alert unknown ca

All others components that use my MQTTS server work fine with certs.

Thanks for help!

[ismaildasci]

the "unknown ca" error means mosquitto doesnt trust the client cert CA.

the issue is certificate chain validation. try these:

1. check param name - use verify instead of cafile:

mqtts://mqtt.domain.tld:8883/topic?verify=/etc/ssl/mosquitto/ca.pem&certfile=/etc/ssl/mosquitto/cert.pem&keyfile=/etc/ssl/mosquitto/cert.key

2. or try with verify=no temporarily to test:

mqtts://mqtt.domain.tld:8883/topic?verify=no

if this works, its definitely cert validation issue

3. check mosquitto config has cafile for client certs:

# mosquitto.conf
require_certificate true
cafile /etc/ssl/mosquitto/ca.pem
certfile /etc/ssl/mosquitto/server.pem  
keyfile /etc/ssl/mosquitto/server.key

4. verify cert chain:

openssl verify -CAfile ca.pem cert.pem

5. check if intermediate CA is needed:
   if your cert is signed by intermediate, concatenate:

cat cert.pem intermediate.pem > fullchain.pem

the "tlsv1 alert unknown ca" specifically means server doesnt recognize the CA that signed client cert

[caronc]

Add &verify=no to your Apprise mqtts:// URL can bypass the error. Useful if your key is self signed.

[fred-gb]

Thanks for your answers!

With &verify=no That doesn't work either.

My MQTT broker requires a valid certificate.

I created a mqtt_publish.py that uses the sames certs and that works.

I can't use Apprise... 😢