I am having some trouble with Mosquitto (MQTT) over SSL (with letsencrypt).
I have it installed on a RoR Ubuntu 18.04 server, on Digital Ocean, with Nginx installed.
This setup worked perfectly for public messages.
Then, for communication over SSL, port 8883 is listening to all traffic on the domain name.
The ports are allowed in firewall.
My Problem is, whenever I try to publish over SSL, I get an error. Here's the full log:
$mosquitto_pub -d -h my-domain.xyz -t test -m "hello again" -p 8883 --capath /etc/ssl/certs/ -u “some-user” -P "p#s$w0rd"
Client mosqpub|23889-mosquitto sending CONNECT
Client mosqpub|23889-mosquitto received CONNACK
Connection Refused: not authorised.
Error: The connection was refused.
Here is my ../conf.d/default.conf
allow_anonymous false
password_file /etc/mosquitto/passwd
listener 1883 localhost
listener 8883
certfile /etc/letsencrypt/live/my-domain.xyz/cert.pem
cafile /etc/letsencrypt/live/my-domain.xyz/chain.pem
keyfile /etc/letsencrypt/live/my-domain.xyz/privkey.pem
Sample password file from /etc/mosquitto/passwd:
some-user:$6$SzAZtOMrxYGiECMU$1YMk4lnmY8FRTZj/vy1FLsnegsxx4OXSzX60rX7ej+muz1i6//16BKwkvwXYYYg2+7w9SRYaeuKPfA9Q==
Command to subscribe
mosquitto_sub -h domain.xyz -t "test" -u "some-user" -P "p#s$w0rd"
Log as found in /var/log/mosquitto/mosquitto.og
1568255494: Opening ipv4 listen socket on port 8883.
1568255664: mosquitto version 1.4.15 terminating
1568523128: mosquitto version 1.4.15 (build date Tue, 18 Jun 2019 11:42:22 -0300) starting
1568523397: mosquitto version 1.4.15 (build date Tue, 18 Jun 2019 11:42:22 -0300) starting
1568523397: Config loaded from /etc/mosquitto/mosquitto.conf.
1568523397: Opening ipv4 listen socket on port 1883.
1568523397: Error: Address already in use
1568523128: Config loaded from /etc/mosquitto/mosquitto.conf.
1568523128: Opening ipv4 listen socket on port 8883.
1568523397: mosquitto version 1.4.15 terminating
When I run mosquitto client in blocking mode by manually providing the conf file, here's what I get:
$ mosquitto -c /etc/mosquitto/conf.d/default.conf
1568594709: mosquitto version 1.4.15 (build date Tue, 18 Jun 2019 11:42:22 -0300) starting
1568594709: Config loaded from /etc/mosquitto/conf.d/default.conf.
1568594709: Opening ipv4 listen socket on port 1883.
1568594709: Opening ipv4 listen socket on port 8883.
1568594709: Opening ipv6 listen socket on port 8883.
1568594709: Error: Unable to load CA certificates. Check cafile "/etc/letsencrypt/live/my-domain.xyz/chain.pem".
Does it look like a permissions problem?
I followed the following guide, on an Ubuntu 18.04 : https://www.digitalocean.com/community/tutorials/how-to-install-and-secure-the-mosquitto-mqtt-messaging-broker-on-ubuntu-16-04
What could be going wrong?
I can provide any other details that you want.
Related
I am trying to configure my MQTT broker(mosquito) to connect with MQTT client over SSL. For that I created ca.crt , server.crt, and server.key.
Then I edited the mosquito config file like this:
listener 8883
certfile /etc/mosquitto/ca_certificates/server.crt
cafile /etc/mosquitto/ca_certificates/ca.crt
keyfile /etc/mosquitto/ca_certificates/server.key
require_certificate false
use_identity_as_username true
When creating these certificates, I have made sure to add the common name to 127.0.0.1 as suggested in this guide
After that I run my mosquito broker using the config file that I created using:
mosquitto -c /etc/mosquitto/conf.d/password.conf
This command starts my MQTT broker and it starts listening at port 8883.
1645181786: mosquitto version 2.0.11 starting
1645181786: Config loaded from /etc/mosquitto/conf.d/password.conf.
1645181786: Opening ipv4 listen socket on port 8883.
1645181786: Opening ipv6 listen socket on port 8883.
1645181786: mosquitto version 2.0.11 running
Uptil here, I believe that now my broker will only allow connection at port 8883 only when ca.crt is provided in the connection call.
So, then I use this pub command to send a message to a test topic.
mosquitto_pub -h 127.0.0.1 -p 8883 --cafile /etc/mosquitto/ca_certificates/ca.crt -t test -m 45
But it results in following error:
1645182944: New connection from 127.0.0.1:58926 on port 8883.
1645182944: Client auto-7B1E49DA-54C1-532B-3948-35FFD3A11250 disconnected, not authorised.
Then I added a password file and added path to that password file in my mosquitto config file. My new config file started looking like this:
listener 8883
password_file /etc/mosquitto/conf.d/passwords
certfile /etc/mosquitto/ca_certificates/server.crt
cafile /etc/mosquitto/ca_certificates/ca.crt
keyfile /etc/mosquitto/ca_certificates/server.key
require_certificate false
use_identity_as_username true
After this update when I run the mosquitto_pub command with both my certificates and username, password. The client successfully connects to broker.
mosquitto_pub -h 127.0.0.1 -p 8883 --cafile /etc/mosquitto/ca_certificates/ca.crt -t test -m 45 -u "user" -P "pass123"
Note: if I run the pub command using only certs or only with password, it doesn't connect and it shouldn't too. Giving both attributes work only.
But what I want is to connect using only SSL certificates. Any help would be much appreciated.
The problem is probably use_identity_as_username true which tells mosquitto to use the client certificate's CN as the username.
But you are not sending a client certificate (the --cafile option is passing a CA cert to verify the brokers cert) in any of the examples you are showing, so remove that line from the config and see if it works.
EDIT:
If you also don't want to need to supply a username/password (or use a client certificate to identify a user) you need to include the allow_anonymous true configuration option.
When I use mosquitto to establish a TLS connection with my client program on a router, it doesn't work.
Here is the error log:
[21028.515924]~DLT~14068~INFO ~FIFO /tmp/dlt cannot be opened. Retrying later...
1635324116: mosquitto version 1.6.9 starting
1635324116: Config loaded from /etc/mosquitto/mosquitto.conf.
1635324116: Opening ipv4 listen socket on port 8883.
1635324116: Opening ipv6 listen socket on port 8883.
1635324132: New connection from 192.168.8.1 on port 8883.
1635324132: OpenSSL Error[0]: error:1408F10B:SSL routines:ssl3_get_record:wrong version number
1635324132: Socket error on client <unknown>, disconnecting.
Here is my mosquitto.conf:
port 8883
cafile /mnt/d/Files/Desktop/Project/cert/ca/ca.crt
certfile /mnt/d/Files/Desktop/Project/cert/broker/broker.crt
keyfile /mnt/d/Files/Desktop/Project/cert/broker/broker.key
require_certificate true
tls_version tlsv1.2
Here is my client SSL code:
ssl_opts.trustStore = "/mnt/d/Files/Desktop/Project/cert/ca/ca.crt";
ssl_opts.keyStore = "/mnt/d/Files/Desktop/Project/cert/client/client.crt";
ssl_opts.privateKey = "/mnt/d/Files/Desktop/Project/cert/client/client.key";
ssl_opts.enableServerCertAuth = 1;
ssl_opts.verify = 1;
ssl_opts.sslVersion = MQTT_SSL_VERSION_TLS_1_2;
Here is more specific code of my client:
publisher.h
publisher.c
agent.c
From the docs:
An optional array of null-terminated strings specifying the servers to
which the client will connect. Each string takes the form
protocol://host:port. protocol must be tcp or ssl. For host, you can
specify either an IP address or a host name. For instance, to connect
to a server running on the local machines with the default MQTT port,
specify tcp://localhost:1883. If this list is empty (the default), the
server URI specified on MQTTClient_create() is used.
Make sure your URL starts with ssl:// not just an IP address and port.
I am trying to use TLS for communicating over mqtt. I have ubuntu installed in my system. For using TLS, I have created certificates using the below link:
http://www.embedded101.com/Blogs/PaoloPatierno/entryid/366/mqtt-over-ssl-tls-with-the-m2mqtt-library-and-the-mosquitto-broker
I am able to create certificates. But when I give value to bind_address property in the mosquitto_m2mqtt.conf file and start mosquitto using the command mosquitto -c mosquitto_m2mqtt.conf, I get error as given in the subject of the question; i.e., Error: cannot assign requested address. Please let me know how to resolve this.
Below is the content of config file:
port 8883
bind_address iothdp02
cafile /etc/mosquitto/m2mqtt_ca.crt
certfile /etc/mosquitto/m2mqtt_srv.crt
keyfile /etc/mosquitto/m2mqtt_srv.key
tls_version tlsv1
When I run the command mosquitto -c mosquitto_m2mqtt.conf -v, I am getting as error as:
1551089294: mosquitto version 1.4.8 (build date 2016-09-21 11:21:45+0530) starting
1551089294: Config loaded from mosquitto_m2mqtt.conf.
1551089294: Opening ipv4 listen socket on port 8883.
1551089294: Error: Cannot assign requested address
Edit 1:
I have removed bind_address from config file and starting mosquitto with the new config file with 'mosquitto -c mosquitto_m2mqtt.conf -v'. Mosquitto starts, but when I run mosquitto_sub command, I am getting error as below:
mosquitto -c mosquitto_m2mqtt.conf -v
1551172930: mosquitto version 1.4.8 (build date 2016-09-21 11:21:45+0530) starting
1551172930: Config loaded from mosquitto_m2mqtt.conf.
1551172930: Opening ipv4 listen socket on port 8883.
1551172930: Opening ipv6 listen socket on port 8883.
Enter PEM pass phrase:
1551172960: New connection from 127.0.0.1 on port 8883.
1551172960: OpenSSL Error: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown
1551172960: OpenSSL Error: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure
1551172960: Socket error on client <unknown>, disconnecting.
In the window that I am subscribing, I am getting error as below:
mosquitto_sub -p 8883 -q 1 -t sensor/temp --cafile /etc/mosquitto/m2mqtt_srv.crt --tls-version tlsv1 -d
Unable to connect (A TLS error occurred.).
If you pass a hostname to the bind_address argument it must resolve to a valid IP address, this is not necessarily the same as the output from hostname.
This has nothing to do with the TLS/certificate setup it is purely how mosquitto identifies which address to bind to.
You have a few choices on how to fix this:
remove the bind_address line, this will cause mosquitto to listen on all available addresses
ensure that what ever you use in the bind_address field resolves to an IP address bound to an interface on the machine the broker is running. This might mean using the fully qualified domain name (you probably should have used that in the broker's certificate CN as well)
replace the hostname with the ip address for the interface you want mosquitto to listen on.
I've managed to setup a broker using SSL using Let's Encrypt certs.
I've tried testing a websockets client connecting to wss://broker:9002/mqtt, and it's working. I've also tried using mqtt.js command-line interface to subscribe to a topic on the broker mqtts://broker:8883/mqtt successfully.
However, I can't get mosquitto_sub and mosquitto_pub to work.
I tried with,
$ mosquitto_sub -h www.my-host.com.ar -p 8883 -t hello -d --cafile fullchain.pem
Client mosqsub/21069-atlantis sending CONNECT
Error: A TLS error occurred.
where fullchain.pem is the same ca cert that's on the server.
The mosquitto.log's broker shows,
1456709201: OpenSSL Error: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
1456709201: OpenSSL Error: error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure
1456709201: Socket error on client <unknown>, disconnecting.
1456709206: New connection from <my-ip> on port 8883.
What could be happening? I didn't provide any cert for mqtt.js lib...
This is my broker conf (splitted in two files),
#################################
# /etc/mosquitto/mosquitto.conf #
#################################
pid_file /var/run/mosquitto.pid
persistence true
persistence_location /var/lib/mosquitto/
log_dest file /var/log/mosquitto/mosquitto.log
listener 1883
listener 8883
cafile /etc/letsencrypt/live/www.my-host.com.ar/fullchain.pem
certfile /etc/letsencrypt/live/www.my-host.com.ar/cert.pem
keyfile /etc/letsencrypt/live/www.my-host.com.ar/privkey.pem
include_dir /etc/mosquitto/conf.d
#############################################
# /etc/mosquitto/conf.d/websockets_ssl.conf #
#############################################
listener 9002
protocol websockets
cafile /etc/letsencrypt/live/www.my-host.com.ar/fullchain.pem
certfile /etc/letsencrypt/live/www.my-host.com.ar/cert.pem
keyfile /etc/letsencrypt/live/www.my-host.com.ar/privkey.pem
Try adding "--insecure" at the end of the mosquitto_sub and mosquitto_pub commands. This allows the clients to bypass the check that matches the certificate hostname with the remote host name. I've had to do this with some of the self-signed certs that I generated.
Here is the relevant comments from the "--help" for those commands:
--insecure : do not check that the server certificate hostname matches the remote
hostname. Using this option means that you cannot be sure that the
remote host is the server you wish to connect to and so is insecure.
Do not use this option in a production environment.
I am trying to connect to one Linux server from a client,
openssl s_client -connect <IP of Server>:443
I am getting the following error:
socket: Connection refused
connect:errno=111
Check the ports of the server by any tool.
For Example,
nmap <IP>
Starting Nmap 5.21 ( http://nmap.org ) at 2015-05-05 09:33 IST
Nmap scan report for <IP>
Host is up (0.00036s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open *****
139/tcp open *****
443/tcp open openssl
MAC Address: 18:03:73:DF:DC:62 (Unknown)
Check the port number is in openstate.
As I mentioned in the comment that the host name is missing. You would mention is right before the port number.
$ openssl s_client -connect myHost.com:443
Edit: now that you mention that there is a hostname in the command so we are fine there. Now check to see if host/port is blocked. To check you can use nmap or telnet or any other port scanner.
If you can ping / connect to the host but not to the server process available on a particular port then there is a firewall blocking access.
The firewall could be on the host and if iptables is the firewall(assuming Linux) then you need to add a rule to allow the connection. For a quick test, you could disable the firwall (NOT RECOMMENDED). Or you could run the server process on a port that is open.
This has nothing to do with SSL. Connection refused means that either there is no server or the connection is blocked by firewall. In your case (before your edit) the server is also plain wrong, i.e. ":443" is no valid server name (hostname missing).