Connection to Broker with TLS

[alberto-y]

Hi,
please can you give a try to connect to a broker with TLS enabled and username and password?
Indifferent with or without certificate validation, it works in both way (I changed personal data of MySql server) :
./mqtt2sql.py --mqtt mqtts://mqtt2sql:[email protected]/# --sql-type mysql --sql-host localhost --sql-username user--sql-password 'password' --sql-db mqtt -v -dd

I'm able to connect to the broker, subscribe and post, with MQTT Explorer and with MQTTX, with TLS on the port 8883, with or without certificate validation.
But it seems that's a problem with the Python script.

This is the only output i receive, but the script doesn't write in the DB :

2023-02-21 15:29:52: mqtt2sql.py[15370] v2.5.5 start
2023-02-21 15:29:52:   MQTT server: rc95fb8c.ala.us-east-1.emqxsl.com:8883  keepalive 60
2023-02-21 15:29:52:        user:   mqtt2sql
2023-02-21 15:29:52:        topics: #
2023-02-21 15:29:52:        exclude: None
2023-02-21 15:29:52:   SQL  type:   MySQl
2023-02-21 15:29:52:        server: localhost:3306 [max 50 connections]
2023-02-21 15:29:52:        db:     mqtt
2023-02-21 15:29:52:        table:  mqtt
2023-02-21 15:29:52:        user:   user
2023-02-21 15:29:52:   Debug level: 2
2023-02-21 15:29:52:   Verbose level: 1
2023-02-21 15:29:52: mqttc.connect(rc95fb8c.ala.us-east-1.emqxsl.com, 8883, 60)
2023-02-21 15:29:52: mqttc.connect() returns 0

Moreover with my personal broker on the LAN, with certificate usage but without validation, I have different error, for this I moved to an external certified one, to avoit server misconfiguration:
ERROR:__main__:failed to receive on socket: [Errno 104] Connection reset by peer
Also in this case I have not any kind of problem with MQTT Explorer and MQTTX client, with TLS enabled.
If you want, also in this case, I can provide you (better in private message) an access to try to connect with your script

[curzon01]

You need to add the name of the ca file, rc95fb8c.ala.us-east-1.emqxsl.com uses "ISRG Root X1" as ca so --mqtt-cafile = /etc/ssl/certs/ISRG_Root_X1.pem should work.

[alberto-y]

With :
./mqtt2sql.py --mqtt mqtts://mqtt2sql:[email protected]/# --mqtt-cafile /etc/ssl/certs/ISRG_Root_X1.pem --sql-type mysql --sql-host localhost --sql-username username --sql-password 'password' --sql-db mqtt -v -dd
I get:

rc95fb8c.ala.us-east-1.emqxsl.com:8883 failed - [2] A network protocol error occurred when communicating with the broker.

Same result with --mqtt-insecure
If you want, you can make a try, the broker user posted it's active, it's a temp broker for testing purposes
I checked and the cafile it's present of the client

[alberto-y]

I have more information :

1. It seems there's a problem with the loopback connection when I try to connect to local broker using "localhost" or "127.0.0.1", only with mqtts.
   127.0.0.1:8883 failed - [2] A network protocol error occurred when communicating with the broker.
localhost:8883 failed - [2] A network protocol error occurred when communicating with the broker.
   with
   ./mqtt2sql.py --mqtt mqtts://usern:[email protected]/# --mqtt-cafile /etc/ssl/certs/ISRG_Root_X1.pem --sql-type mysql --sql-host localhost --sql-username user --sql-password 'password' --sql-db mqtt -v -dd
./mqtt2sql.py --mqtt mqtts://usern:pass@localhost/# --mqtt-cafile /etc/ssl/certs/ISRG_Root_X1.pem --sql-type mysql --sql-host localhost --sql-username user --sql-password 'password' --sql-db mqtt -v -dd
   The same problem it's not present without TLS on the port 1883, in this configuration I can use "localhost"
2. I have a loopback problem with the firewall, so I can't use in the same VM the script and the Broker, neither another PC in the same LAN, but I need it :
   mqtt.myurl.com:8883 failed - [2] A network protocol error occurred when communicating with the broker.
   If I start the script from another client outside the LAN, the script works fine both with 1883 in clear, and 8883 with TLS -->
   ./mqtt2sql.py --mqtt mqtts://user:[email protected]/# --mqtt-cafile /etc/ssl/certs/ISRG_Root_X1.pem --sql-type mysql --sql-host localhost --sql-username user --sql-password 'password' --sql-db mqtt -v -dd
3. Using instead rc95fb8c.ala.us-east-1.emqxsl.com broker from both VM, the problem is what I wrote above
   Same "string", I change only username, password and the URL of the broker

[curzon01]

mqtt2sql MQTT connections are made by Eclipse Paho MQTT Python client library, is does not make the connections by themself, it simply push the parameter given to the library function and returns their result. Also TLS connections are fully handled by the library itself.