steps to configure ssl/tls emqx mqtt broker

[raheem071989]

Dear Team,

we have ssl.key and ssl.crt files and below is the configuration file of emqx.conf. Able to connect on port 1883, 8083 on option mqtt:// and ws://. if i use wss:// with port 8084 and mqtts:// with port 8084 it gives me error self signed certificate

please help as i am getting the Error: self signed certificate in certificate chain

cat emqx.conf

node {
name = "[email protected]"
cookie = "emqxsecretcookie"
data_dir = "/var/lib/emqx"
}

cluster {
name = emqxcl
discovery_strategy = manual
}

log {
# file {
# level = warning
# }
# console {
# level = warning
# }
}
dashboard {
listeners.http {
bind = 18083
}
}

listener.tcp.external.allow_anonymous = false
listener.tcp.external.credential.username = "abc"
listener.tcp.external.credential.password = "abc@123"

listener.wss.external = 8083
listener.tcp.external.credential.username = "abc"
listener.tcp.external.credential.password = "abc@123"

listener.wss.external.secure = true
listener.wss.external = 8084
listener.wss.external.certfile = "etc/certs/ssl.crt"
listener.wss.external.keyfile = "etc/certs/ssl.key"
listener.tcp.external.credential.username = "abc"
listener.tcp.external.credential.password = "abc@123"

[thalesmg]

Hi.

In order to complete the certificate chain, you need to add the CA certificate that you used to generate ssl.crt to the configuration.

Assuming it's called intermediate.crt and placed in etc/certs, you would add a new configuration line:

listener.wss.external.cacertfile = "etc/certs/intermediate.crt`

[raheem071989]

Dear Thales,

Thank you for the update.

In this case as we have purchased this certificate from Godaddy we have two files in it ssl.key and ssl.crt

i am confused with the file which i need to upload

Thanks & Regards,

Mohammed.Raheem

[thalesmg]

If Godaddy's (intermediate?) CA is not part the system's trusted CA certificate, then you should add it to cacertfile. You could ask their support for the CA certificate that issued your files, and then add it to the config.

[raheem071989]

Yes, we have along with it we have .crt and 1 .pem file

[thalesmg]

Great, so it should be added to the configuration along with the server certificate and key as mentioned above.

[raheem071989]

Dear Thales,

Below is the emqx.conf file

listener.wss.external.secure = true
listener.wss.external.acceptors = 16
listener.wss.external.max_clients = 1024
listener.wss.external = 8084
listener.wss.external.certfile = "etc/certs/ssl.crt"
listener.wss.external.keyfile = "etc/erts/ssl.key"
listener.wss.external.cacertfile = "etc/certs/intermediate.crt"
listener.tcp.external.credential.username = "abc"
listener.tcp.external.credential.password = "abc@123"

cat emqx.log.1

2024-05-05T08:20:23.788091+03:00 [warning] msg: config_key_not_recognized, unknown_config_keys: listener
2024-05-05T08:38:01.277285+03:00 [warning] msg: config_key_not_recognized, unknown_config_keys: listener

still i am getting the same error as uploaded the intermediate certificate file.

when we register for domain in godaddy, we get 3 files

1.96f8f0b9ac35c631.crt
2.gd_bundle-g2-g1.crt
3. ca.pem

so in ssl.crt , we have concatenated this 2 files 96f8f0b9ac35c631.crt and .gd_bundle-g2-g1.crt
where in intermediate.crt, we have renamed gd_bundle-g2-g1.crt to intermediate.crt

but still the result is same "Error: self signed certificate in certificate chain"

I need your help to resolve this, please i have shared the log files as well.

Thanks & Regards,
Mohammed.Raheem

[ieQu1]

2024-05-05T08:20:23.788091+03:00 [warning] msg: config_key_not_recognized, unknown_config_keys: listener
2024-05-05T08:38:01.277285+03:00 [warning] msg: config_key_not_recognized, unknown_config_keys: listener

This warning is telling you exactly what is wrong: listener is not a valid configuration key.
If you use 5.x, then the appropriate config key is listeners. https://www.emqx.io/docs/en/latest/configuration/listener.html#configure-ssl-listener

[raheem071989]

node {
name = "[email protected]"
cookie = "emqxsecretcookie"
data_dir = "/var/lib/emqx"
}

cluster {
name = emqxcl
discovery_strategy = manual
}

log {
# file {
# level = warning
# }
# console {
# level = warning
# }
}
dashboard {
listeners.http {
bind = 18083
}
}
listeners.wss.default {
bind = "0.0.0.0:8084"
max_connections = 1024000
websocket.mqtt_path = "/mqtt"
ssl_options {
cacertfile = "etc/emqx/certs/intermediate.crt"
certfile = "etc/emqx/certs/ssl.crt"
keyfile = "etc/emqx/certs/ssl.key"
}
}

systemctl restart emqx

systemctl status emqx

● emqx.service - emqx daemon
Loaded: loaded (/usr/lib/systemd/system/emqx.service; enabled; preset: disabled)
Active: activating (auto-restart) (Result: core-dump) since Mon 2024-05-06 05:21:>
Process: 3265841 ExecStart=/bin/bash /usr/bin/emqx foreground (code=dumped, signal>
Main PID: 3265841 (code=dumped, signal=SEGV)
CPU: 5.370s

May 06 05:21:23 tibdc-qa-mobile systemd[1]: emqx.service: Consumed 5.370s CPU time.

As soon as i add the listeners , then emqx service will get failed. please suggest

[raheem071989]

Dear Team,

Could you please help in enabling user authentication here for wss and ssl configuration on port 8883 and 8084.

how to add username and password for this

cat emqx.conf

#listeners.tcp.default {

bind = "0.0.0.0:1883"

max_connections = 1024000

#}

listeners.ssl.default {
bind = "0.0.0.0:8883"
max_connections = 1024000
ssl_options {
cacertfile = "/etc/emqx/certs/int.pem"
certfile = "/etc/emqx/certs/ssl.pem"
keyfile = "/etc/emqx/certs/sslkey.pem"
verify = verify_none
fail_if_no_peer_cert = false
}
}

listeners.wss.default {
bind = "0.0.0.0:8084"
max_connections = 1024000
websocket.mqtt_path = "/mqtt"
ssl_options {
cacertfile = "/etc/emqx/certs/int.pem"
certfile = "/etc/emqx/certs/ssl.pem"
keyfile = "/etc/emqx/certs/sslkey.pem"
verify = verify_none
fail_if_no_peer_cert = false
}
}

Thanks & Regards,
Mohammed.Raheem

[raheem071989]

we want to move from open source to enterprise whom shall we contact. however i have fill the form in emqx enterprise web form but no one is repsonding

[kjellwinblad]

Hi, I will forward this information to one person in our sales team. Thanks!

[raheem071989]

Dear Kjell, Thank you for the update, I am waiting for their call. Thanks & Regards, Mohammed.Raheem +971565977445

…

On Mon, 6 May 2024 at 13:04, Kjell Winblad ***@***.***> wrote: Hi, I will forward this information to one person in our sales team. Thanks! — Reply to this email directly, view it on GitHub <#12969 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BBUY2742MEX7HBOZSALNBKTZA5BSLAVCNFSM6AAAAABHFNWMF6VHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TGMRWGY3TM> . You are receiving this because you authored the thread.Message ID: ***@***.***>