MQTT TLS with VPS: Mosquitto TLS error (SAN settings?)

Question

I tried to follow the approach from this suggested answer, but still I can't get the settings right. Output of mosquitto_sub (depending on different CA settings):

mosquitto_sub --host abc.xyz.com --port 12345 --cafile /.../ca.crt --topic testtopic --username testuser --pw abcdef --debug
Client mosq-2d2wYFdFpeB8tc8Vmr sending CONNECT
OpenSSL Error[0]: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed
Error: A TLS error occurred.

Client mosq-0dfENGm0nj8iunicEY sending CONNECT
OpenSSL Error[0]: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
Error: A TLS error occurred.

Output of $ user% openssl x509 -in mosquitto.crt -text -noout:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            54:01:4f:99:1d:88:ff:7e:13:ed:52:24:38:0e:79:b6:7a:17:47:d2
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=abc.xyz.com
        Validity
            Not Before: Sep 15 23:09:47 2022 GMT
            Not After : Sep 15 23:09:47 2023 GMT
        Subject: CN=abc.xyz.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:a3:94:c0:cc:a4:ab:0a:5c:a0:bf:e1:c3:05:4d:
                    19:34:0d:e7:66:d9:c5:d2:f3:a1:85:58:1d:dd:83:
                    30:20:11:35:59:33:00:90:de:51:f6:e7:48:79:19:
                    f6:03:1f:e8:ec:70:95:ce:0b:30:24:1e:59:8a:8e:
                    9e:a7:95:3f:f8:2d:4a:5a:53:9d:70:19:3a:2a:b4:
                    25:d7:90:8d:65:5a:db:4a:ce:3f:d5:68:e7:8d:b2:
                    a7:10:e3:70:e8:ae:dd:0a:5a:a4:f3:7a:d7:37:94:
                    7d:97:04:3f:d0:5c:55:97:b4:78:e3:0a:37:41:c3:
                    f3:04:0c:ec:b5:62:ed:0e:f0:3b:53:fe:5a:1c:1d:
                    be:6f:a7:04:b3:7b:e5:9c:e1:24:af:13:41:d6:9c:
                    25:57:81:0d:a0:9a:3a:03:e7:2a:ef:32:be:dc:c9:
                    8d:d6:ff:10:27:fd:fb:43:03:90:21:17:ed:33:50:
                    5f:6c:3b:fe:20:62:b4:a2:16:d4:68:5d:67:2d:6b:
                    04:e5:a7:2b:4c:5b:ea:65:a8:42:f1:0c:67:f0:90:
                    d9:06:da:b4:5e:73:27:f5:37:54:5b:dc:a8:cf:73:
                    3e:df:12:c5:e0:f9:90:a1:62:ec:6b:7a:7b:54:15:
                    bd:9e:5d:1d:dc:69:d0:8d:62:86:69:74:fb:a7:3c:
                    a6:f3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                DNS:abc.xyz.com
            X509v3 Subject Key Identifier: 
                D6:91:BE:EC:0F:5B:FA:D6:43:62:5A:7E:EA:06:72:8C:3B:9B:84:68
            X509v3 Authority Key Identifier: 
                keyid:19:E7:9C:9E:5C:7B:BA:FD:05:53:53:7C:A1:DC:B8:5C:7F:F5:4B:0D

    Signature Algorithm: sha256WithRSAEncryption
         38:bc:3c:4e:f9:3f:4e:49:35:69:7b:c4:48:8f:5d:f7:ac:48:
         e1:10:90:45:2f:41:9d:4b:d5:54:6f:07:5d:d6:f6:33:1d:a8:
         6a:09:70:a7:fc:74:a6:58:43:2d:a3:5e:19:8a:9f:7c:18:2e:
         8d:82:38:99:f0:76:af:3d:00:a3:77:ff:e4:80:64:60:eb:fc:
         c8:1c:b1:12:bb:47:80:ab:50:56:cf:a8:c1:46:0c:aa:df:eb:
         94:1e:e3:47:8e:03:85:2c:52:f0:b9:81:9e:33:65:7a:46:79:
         64:77:4d:b4:62:ad:63:1a:ae:ee:1e:a2:4c:a6:5a:5b:f9:b8:
         e1:2c:e1:28:8a:83:17:08:99:90:15:9d:9a:e8:ca:1b:39:66:
         bb:8c:c3:33:fc:ff:9c:68:8b:ee:ea:31:a4:ff:e0:86:00:80:
         74:e3:2f:f2:7e:0c:b3:3c:74:37:1b:81:cf:de:53:02:8a:53:
         d2:fd:a3:56:7f:4a:ba:7d:e9:62:d0:77:0a:86:6b:58:da:d3:
         2f:34:57:eb:9e:29:a3:32:a6:f9:46:53:79:c9:77:c0:0e:04:
         21:13:39:b4:d3:b8:06:5d:55:f8:3d:17:9f:52:4f:37:e7:e3:
         82:f0:2a:12:3c:6c:cb:64:35:eb:f0:ea:a6:2f:db:0a:2d:0f:
         37:9d:ac:4c

I set up the certificates the following:

# CA:
openssl genrsa -des3 -out ca.key 2048
openssl req -new -key ca.key -out ca-cert-request.csr -sha256
openssl req -x509 -nodes -newkey rsa:2048 -days 3650 -sha256 -keyout ca.key -out ca.crt -reqexts SAN -extensions SAN -subj '/CN=CAAUTH' -config <(cat /etc/ssl/openssl.cnf; printf "[SAN]
subjectAltName=DNS:abc.xyz.com")
# mosquitto server:
openssl genrsa -out mosquitto.key 2048
openssl req -new -key mosquitto.key -out mosquitto-cert-request.csr -sha256
openssl req -x509 -nodes -days 365 -new -out mosquitto.crt -key mosquitto.key -CA ca.crt -CAkey ca.key -newkey rsa:2048 -reqexts SAN -extensions SAN -subj '/CN=abc.xyz.com' -config <(cat /etc/ssl/openssl.cnf; printf "[SAN]
subjectAltName=DNS:abc.xyz.com")

My mosquitto configuration file looks like this:

port 43340
allow_anonymous false
cafile /home/user/etc/mosquitto/ca_certificates/ca.crt
keyfile /home/user/etc/mosquitto/certs/mosquitto.key
certfile /home/user/etc/mosquitto/certs/mosquitto.crt
require_certificate true
log_type all
password_file /home/user/etc/mosquitto/passwd

After setting it up like this and restarting mosquitto my ESP32 connects (mqtt_client state: 0) and also mosquitto is running. In the supervisord.log is see:

2022-09-14 15:48:09,408 DEBG 'mosquitto' stderr output:
1663163289: Received PUBLISH from ESP32 (d0, q0, r0, m0, 'testtopic', ... (2 bytes))

So, I assume everything is working fine from the client side - but why isn't mosquitto running properly? So far I tried:

Multiple tutorials (including the quite recent one from steves-internet-guide)
Generating new Certificates
- with different CN entires (IP, FQDN, localhost)
- used a subjectAltName for the Certificate (but more like trial and error)
modified the mosquitto.conf, e.g. require_certificate true/false
added the SAN (only CA/server, both, with IP, DNS, different settings from other answers)

MQTT TLS with VPS: Mosquitto TLS error (SAN settings?)

0 Answers