How do you set up encrypted mosquitto broker like a webpage which has https?

Question

I'm trying to setup a mosquitto broker which is encrypted using ssl/tls. I don't want to generate client certificates. I just want an encrypted connection.

The man page only described the settings which are available, not which are needed and how they are used.

Which settings are needed and how do you set them?

I use mosquitto 1.3.5

Answer 1

There is a small guide here, but it does not say much: http://mosquitto.org/man/mosquitto-tls-7.html

You need to set these: certfile keyfile cafile

They can be generated with the commands in the link above. But easier is to use this script: https://github.com/owntracks/tools/blob/master/TLS/generate-CA.sh

After running the script and changing the config it could look something like this:

listener 8883
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/hostname.localdomain.crt
keyfile /etc/mosquitto/certs/hostname.localdomain.key

If mosquitto says Unable to load server key file it means that the user which is running mosquitto does not have permission to read the file. Even if you start it as root the broker might start as another user, mosquitto for example. To solve this do e.g. chown mosquitto:root keyfile

To connect to the broker the client will need the ca.crt-file. If you do not supply this the broker will say something like:

OpenSSL Error: error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number

To supply it to the mosquitto_sub command you use --cafile pathToCaCrt. The ca.crt can be distributed with the clients and it will make sure that the server it is connected to actually is the correct server.

The --insecure flag of mosquitto_sub does not make the client accept all certificates (like with wget or similar), it just allows that the certificate not to have the host you are connecting to in common name. So you should make sure your certificate has your broker host as common name.