Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

TLS issues with mosquitto-1.6.4

See original GitHub issue

I recently (2 days ago) upgraded from mosquitto upgraded: 1.5.8 -> 1.6.4

No configuration changes were made after the upgrade. Both mosquitto and mqttwarn run on the same FreeBSD jail. There was a reboot of the host after the upgrade. There was no mqtt issue then. Which makes the following all the more surprising.

I have confirmed the mosquitto cert is not expired: Not After : Dec 22 02:19:10 2019 GMT

$ openssl version
OpenSSL 1.1.1a-freebsd  20 Nov 2018

Today, mqttwarn refuses to connect to mosquitto:

ERROR [mqttwarn] Cannot connect to MQTT broker at mqtt01.example.org:8883: [SSL: TLSV1_ALERT_PROTOCOL_VERSION] tlsv1 alert protocol version (_ssl.c:727)

I also tried sslv3, just in case, but that is not any fun either:

[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure

Any ideas? Are you on Mosquitto 1.6.4

Oh oh, it looks like Moquitto dropped support for tlsv1 in release 1.6 : https://mosquitto.org/blog/2019/04/version-1-6-released/

That seems to be supported by these /var/log/messages entries:

Oct 17 20:01:17 mqtt01 mosquitto[74183]: OpenSSL Error: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol
Oct 17 20:01:17 mqtt01 mosquitto[74183]: Socket error on client <unknown>, disconnecting.

Issue Analytics

State:
Created 4 years ago
Comments:17 (17 by maintainers)

Top GitHub Comments

1reaction

dlangillecommented, Nov 5, 2019

Tried again.

It worked.

1reaction

dlangillecommented, Nov 2, 2019

Tried. Same issue. Hmm.

Top Results From Across the Web

Mosquitto SSL Configuration -MQTT TLS Security

In this tutorial we will configure the mosquitto MQTT broker to use TLS security. We will be using openssl to create our own...

ChangeLog.txt - Eclipse Mosquitto

It was setting the exact TLS version to use, not the minimium TLS version to use. Closes #2110. - Fix messages to `$`...

MQTT TLS configuration: guide with Mosquitto examples

Check out our step-by-step guide on how to configure MQTT TLS for Mosquitto with easy-to-follow examples and ready-to-use snippets of code.

Mosquitto » how to determine which TLS ciphersuite ... - Eclipse

TLS 1.2 and higher is enabled, TLS on port 8883 is enforced, no Reverse-Proxy is used, clients connect directly to mosquitto service.

paho-mqtt · PyPI

If unavailable, TLS v1.2 is used. Previous versions (all versions beginning with SSL) are possible but not recommended due to possible security problems....