Suite a un update de ma machine qui gère les stations Météo, j’ai rencontré des soucis dans l’installation du certificat SSL Let’s Encrypt sur le broker MQTT.

 

Normalement  j’ai suivi ce tuto  : 

https://obrienlabs.net/how-to-setup-your-own-mqtt-broker/

Mais au chapitre pour insérer le SSL dans le fichier de config  , rien  ne fonctionnait  :  

il faut insérer 3 fichiers le certfile, le cafile et le keyfile dans le fichier de configuration :

certfile /etc/letsencrypt/live/xxxx.yyyy.fr/cert.pem
cafile /etc/letsencrypt/live/xxxx.yyyys.fr/chain.pem
keyfile /etc/letsencrypt/live/xxxx.yyyy.fr/privkey.pem

J’avais un message d’erreur du style :

1671805880: mosquitto version 2.0.11 starting
1671805880: Config loaded from /etc/mosquitto/mosquitto.conf.
1671805880: Opening ipv4 listen socket on port 1883.
1671805880: Opening ipv4 listen socket on port 8883.
1671805880: Opening ipv6 listen socket on port 8883.
1671805880: Error: Unable to load CA certificates. Check cafile "/etc/letsencrypt/live/xxxx.yyyy.fr/chain.pem".
1671805880: OpenSSL Error[0]: error:8000000D:system library::Permission denied
1671805880: OpenSSL Error[1]: error:10080002:BIO routines::system lib
1671805880: OpenSSL Error[2]: error:05880002:x509 certificate routines::system lib
1671805880: mosquitto version 2.0.11 starting
1671805880: Config loaded from /etc/mosquitto/mosquitto.conf.
1671805880: Opening ipv4 listen socket on port 1883.
1671805880: Opening ipv4 listen socket on port 8883.
1671805880: Opening ipv6 listen socket on port 8883.
1671805880: Error: Unable to load CA certificates. Check cafile "/etc/letsencrypt/live/xxxx.yyyy.fr/chain.pem".
1671805880: OpenSSL Error[0]: error:8000000D:system library::Permission denied
1671805880: OpenSSL Error[1]: error:10080002:BIO routines::system lib
1671805880: OpenSSL Error[2]: error:05880002:x509 certificate routines::system lib

https://community.letsencrypt.org/t/mqtt-ssl-certificate-expired/163060/16

Mettre le fichier :

cafile /etc/ssl/certs/ca-certificates.crt

mettre egalement les 2 autres fichiers de certicats :

root@meteo-Ubuntu:/etc/mosquitto/certs# pwd
/etc/mosquitto/certs
root@meteo-Ubuntu:/etc/mosquitto/certs# ll
total 20
drwxr-xr-x 2 root root 4096 déc.  23 18:28 ./
drwxr-xr-x 5 root root 4096 déc.  23 16:57 ../
-rw-rw-rw- 1 root root 1854 déc.  23 17:09 cert.pem
-rw-rw-rw- 1 root root 1708 déc.  23 17:09 privkey.pem
-rw-rw-rw- 1 root root  130 févr.  7  2022 README
root@meteo-Ubuntu:/etc/mosquitto/certs#

Oui mais la encore des soucis de demarrage :

2022-12-23_18:23:50: mosquitto version 2.0.11 starting
2022-12-23_18:23:50: Config loaded from /etc/mosquitto/mosquitto.conf.
2022-12-23_18:23:50: Opening ipv4 listen socket on port 1883.
2022-12-23_18:23:50: Opening ipv4 listen socket on port 8883.
2022-12-23_18:23:50: Opening ipv6 listen socket on port 8883.
2022-12-23_18:23:50: Error: Unable to load server certificate "/etc/mosquitto/certs/cert.pem". Check certfile.
2022-12-23_18:23:50: OpenSSL Error[0]: error:8000000D:system library::Permission denied
2022-12-23_18:23:50: OpenSSL Error[1]: error:10080002:BIO routines::system lib
2022-12-23_18:23:50: OpenSSL Error[2]: error:0A080002:SSL routines::system lib

Faire un chmod 0600 des fichiers pem