{var%20f='http://v.t.sina.com.cn/share/share.php?appkey=1515056452',u=z||d.location,p=['&url=',e(u),'&title=',e(t||d.title),'&source=',e(r),'&sourceUrl=',e(l),'&content=',c||'gb2312','&pic=',e(p||'')].join('');function%20a(){if(!window.open([f,p].join(''),'mb',['toolbar=0,status=0,resizable=1,width=440,height=430,left=',(s.width-440)/2,',top=',(s.height-430)/2].join('')))u.href=[f,p].join('');};if(/Firefox/.test(navigator.userAgent))setTimeout(a,0);else%20a();})(screen,document,encodeURIComponent,'','','https://www.manongdao.com/data/attach/logo/logo.png', '推荐 地球回转人心会变 的问题《mosquitto_pub rejecting iot.eclipse.org mqtt serve》','https://www.manongdao.com/q-437265.html','页面编码gb2312|utf-8默认gb2312'));){kind=link}
I am trying to run mosquitto_pub on a Ubuntu linux machine as follows:
vbhadra@vbhadra-VirtualBox:~$ mosquitto_pub -h iot.eclipse.org -p 8883 --capath /etc/ssl/certs/ -t house/s1 -m "test message" -d
Client mosqpub/9204-vbhadra-Vi sending CONNECT
Client mosqpub/9204-vbhadra-Vi received CONNACK
Client mosqpub/9204-vbhadra-Vi sending PUBLISH (d0, q0, r0, m1, 'house/s1', ... (12 bytes))
Client mosqpub/9204-vbhadra-Vi sending DISCONNECT
As can be seen the mosquitto_pub works file. Now I want to experiment downloading the iot.eclipse.org certificate manually and then use that with mosquitto_pub instead of using Ubuntus /etc/ssl/certs/ certificate.
So I did the below:
ex +'/BEGIN CERTIFICATE/,/END CERTIFICATE/p' <(echo | openssl s_client -showcerts -connect iot.eclipse.org:8883) -scq > file.crt
Saved the file.crt in a location as: /home/vbhadra/remote_certificate/.
Now, I try the below again:
mosquitto_pub -h iot.eclipse.org -p 8883 --capath /home/vbhadra/remote_certificate/ -t house/s1 -m "test message" -d
But the above fails miserably. By capturing the tcpdump I can see in the Wireshark that my Ubuntu client is sending "Fatal: Unknown CA" back to the iot.eclipse.org.
From my little understanding so far, I can think the certificate is not signed by any CA and hence the mosquitto client is rejecting it. I have been trying to figure out how I can I get the certificate signed (self sign ??) but no clue so far.
I tried verifying the certificate file I saved file.crt with openssl verify as below:
openssl verify -CApath /home/vbhadra/remote_certs/ /home/vbhadra/remote_certs/file2.crt
/home/vbhadra/remote_certs/file2.crt: CN = iot.eclipse.org
error 20 at 0 depth lookup:unable to get local issuer certificate
At this point I am bit lost. People seems to be suggesting to use .pem certificate file with openssl verify but not sure how to do that, basically I am lost. Please help with any pointer to take it further.
When you run the
echo | openssl s_client -showcerts -connect iot.eclipse.org:8883command and look at the output, it contains multiple certificates which I believe may be an issue with the way you are chopping it up with ex.You will need both of these certs to provide a full certificate chain to verify the end user certificate for iot.eclipse.org.
Also did you run ca_rehash (or c_rehash on ubuntu) in the directory with your ca files?
I had to rename the files to end with
.pem(since this is what they actually are) and copy theDST_Root_CA_X3.pemfile into the ca directory from /etc/ssl/certs as well.Also if you want to use your own private CA then using
--cafilemight be a bit simpler.These are the steps I did following hardillb's answer above:
Notice there are two certificates between the BEGIN and END CERTIFICATE sections. Copy both the certificates in two separate files, like I did copy and saved two certificates in two different files called cert.pem and cert2.pem located in a folder called remote_certificates in my home directory. Now copy the DST_Root_CA_X3.pem file from the /etc/ssl/certs/ folder to the remote_certificates folder.
Now, as was suggested by @hardillb in the above comments run c_rehash:
Now, I have the below files in remote_certificates folder:
Now I run the mosquitto_pub command as below and it works:
Thanks a lot again @hardillb.