CODEWITHSUNDEEP
sslwebsocketmqttmosquitto
Pedro Mendes
Pedro Mendes

Reputation: 13

Mosquitto configuration for Websockets + TLS

I've been using mosquitto + websockets on debian 8 since a while, with great results. Now I'd like to move the system to pre-production, so I need to start encrypting these communications.

I have tried generating the certificates by hand, following the steps found on this blog post (http://embeddedprog.blogspot.pt/2014/05/tlsssl-communication-via-mqtt.html) and with the certificate generation script from J-P Mens (https://github.com/owntracks/tools)

My "mosquitto.conf" looks like this:

allow_anonymous false
allow_duplicate_messages false
autosave_interval 1800
persistence true
persistence_file mosquitto.db
persistence_location /tmp/
connection_messages true
log_timestamp true
#log_dest syslog

#log_type error
#log_type warning
#log_type notice
#log_type information
log_type all
log_type debug


listener 8880
protocol mqtt

listener 8881
protocol websockets
bind_address hi-server
cafile /home/hi/cert/ca.crt
certfile /home/hi/cert/hi.com.crt
keyfile /home/hi/cert/hi.com.key
tls_version tlsv1
#require_certificate false

#
#   __  __       ____   ___  _
#  |  \/  |_   _/ ___| / _ \| |
#  | |\/| | | | \___ \| | | | |
#  | |  | | |_| |___) | |_| | |___
#  |_|  |_|\__, |____/ \__\_\_____|
#          |___/
#
#

#auth_plugin /home/jpm/mosquitto-auth-plug/auth-plug.so
auth_plugin /etc/mosquitto/auth-plug.so
[auth_opt stuff...]

And this is the mosquitto verbose output:

1448802719: mosquitto version 1.4.2 (build date 2015-11-27 23:40:02+0000) starting
1448802719: Config loaded from /etc/mosquitto/mosquitto.conf.
1448802719: |-- *** auth-plug: startup
1448802719: |-- ** Configured order: mysql

1448802719: |-- }}}} MYSQL
1448802719: Opening ipv4 listen socket on port 8880.
1448802719: Opening ipv6 listen socket on port 8880.
1448802719: Opening websockets listen socket on port 8881.
1448802719: New connection from ****** on port 8880.
1448802719: |-- mosquitto_auth_unpwd_check(******)
1448802719: |-- ** checking backend mysql
1448802719: |-- getuser(******) AUTHENTICATED=1 by mysql
1448802719: New client connected from ****** as ****** (c1, k15, u'******').
1448802719: Sending CONNACK to ****** (0, 0)

Whenever I try connecting with the HiveMQ Websockets Client it does a timeout...

Can someone give me an indication of how to achieve this? Help would be much appreciated!

Thanks, Pedro.

UPDATE: managed to connect by importing CA certificate

I have since managed to connect to mosquito using the Paho MQTT client for javascript! I made slight changes to mosquitto.conf:

listener 8880
protocol mqtt

listener 8881
protocol websockets
cafile /home/hi/cert/ca.crt
certfile /home/hi/cert/hi.com.crt
keyfile /home/hi/cert/hi.com.key
tls_version tlsv1
#require_certificate false

The issue I have now is that I'm only able to connect if I have imported the hi.com.crt file and manually set to "Always Trust" on keychain (OS X). Since the certificate is self-signed and not trusted by iOS i can't login using my iPhone...

Shouldn't the default mosquitto TLS behavior be NOT to require the certificate from the client side?

Upvotes: 1

Views: 11667

Answers (1)

hardillb
hardillb

Reputation: 59816

From the comments it sounds like hi-server resolves to 127.0.0.1/localhost. This means that the line in the config that says

bind_address hi-server

Tells mosquitto to only listen for websocket connections on localhost not any of the public interfaces.

Comment this line out and try again

Upvotes: 1

Related Questions