MQTT Username and password

[trsimmons7]

OK - So I've had three BRX using MQTT communicating each through its own cell modem to my MQTT broker. No problems! Everything works as expected. Now its time to complicate things a bit. I went to my broker, created a password file, modified the mosquitto.conf, stopped and restarted the service (its on a windows machine and that is required to reload the conf file) and tested the username/password combination locally using MQTTExplorer. The  broker turned down the anonymous login as it should and when i used the username/password for the local account - it worked.

Now - I take a username/password for one of the BRX and update the mqtt client settings.
Checked 'Enable Account Authentication' , entered a username and password, downloaded program.

No Luck! It doesn't work..... The Do-More error monitor says - 'TCP Connection failed or was unexpectedly closed. in MQTTPUB at $Main@28'. I have powered down both the BRX and the cell modem.

Where to start at troubleshooting this error?

thanks
travis

PS - the documentation for the DMD re the MQTT device setup covering SSL/TLS just kind of stops -- (missing or bad snippet) -- it says. Has this been updated?

[Doug]

This is most likely on the mqtt broker side.  Use command mosquitto_passwd to generate an encrypted passwd file, then restart the broker. 

Plain text passwords don't work if TLS is compiled into the mosquitto broker.

[trsimmons7]

This is most likely on the mqtt broker side.  Use command mosquitto_passwd to generate an encrypted passwd file, then restart the broker. 

Plain text passwords don't work if TLS is compiled into the mosquitto broker.

I was using an encrypted password file - not sure how to implement the SSL/TLS since the DMD documentation for that section sort of abruptly ends.

[BobO]

I was using an encrypted password file - not sure how to implement the SSL/TLS since the DMD documentation for that section sort of abruptly ends.

Select MQTTS from the protocol selection list in the MQTT Client Settings dialog.

[trsimmons7]

I'll be back on that project in a couple of weeks and will try it out then!

thanks
t.

[trsimmons7]

I was using an encrypted password file - not sure how to implement the SSL/TLS since the DMD documentation for that section sort of abruptly ends.

Select MQTTS from the protocol selection list in the MQTT Client Settings dialog.

Ok - I'm back on this --

I can setup a successful MQTT connection on the BRX with port 1883 and no username/password.

I created an encrypted password file.

I restarted the broker and tested the password with MQTT Explorer - everything works.

I enabled username and password in the BRX. I have NOT enabled tls at this time.

It doesn't work. --- Socket error on client <unknown>, disconnecting.

Where to from here?

thanks
t.

[BobO]

It doesn't work. --- Socket error on client <unknown>, disconnecting.

Where to from here?

I would start with something simple. See if you can access the Mosquitto test server at test.mosquitto.org.

[trsimmons7]

It doesn't work. --- Socket error on client <unknown>, disconnecting.

Where to from here?

I would start with something simple. See if you can access the Mosquitto test server at test.mosquitto.org.

How do I do this with a username and password?  -- That's what I am trying first - a simple username/password combo that works. then move onto tls.
I have a tested broker configuration that works with a username/password on a MQTT Explorer client. But when I use that username/password on the BRX it doesn't work.

[BobO]

How do I do this with a username and password?  -- That's what I am trying first - a simple username/password combo that works. then move onto tls.
I have a tested broker configuration that works with a username/password on a MQTT Explorer client. But when I use that username/password on the BRX it doesn't work.

You probably can't. I thought you were testing MQTTS.

I'm not sure what you tell you. The socket level error sounds like a TCP level error, not an MQTT error. Not sure why the username and password would have any influence on that.

[trsimmons7]

How do I do this with a username and password?  -- That's what I am trying first - a simple username/password combo that works. then move onto tls.
I have a tested broker configuration that works with a username/password on a MQTT Explorer client. But when I use that username/password on the BRX it doesn't work.

You probably can't. I thought you were testing MQTTS.

I'm not sure what you tell you. The socket level error sounds like a TCP level error, not an MQTT error. Not sure why the username and password would have any influence on that.

OK - we'll skip the username/password at this time. How do I implement TLS - I don't see how to add my self generated certificate to the BRX.


thanks
t.

[BobO]

How do I implement TLS - I don't see how to add my self generated certificate to the BRX.

MQTTS *is* TLS. You don't need a client side certificate.

We do have plans to implement client side certificates and offer that as an option, but that won't be available until next year.

[trsimmons7]

How do I implement TLS - I don't see how to add my self generated certificate to the BRX.

MQTTS *is* TLS. You don't need a client side certificate.

We do have plans to implement client side certificates and offer that as an option, but that won't be available until next year.

You kinda lost me there (no surprise). 

I am using Mosquitto from Eclipse.

I refer to this page for the certificate requirements.

https://mosquitto.org/man/mosquitto-tls-7.html

[BobO]

You kinda lost me there (no surprise). 

I am using Mosquitto from Eclipse.

I refer to this page for the certificate requirements.

https://mosquitto.org/man/mosquitto-tls-7.html

That is describing how to use OpenSSL to generate certificates. When Mosquitto is configured for MQTTS on port 8883, the broker will need a certificate. We do not yet support client side certificates (that's coming), but you don't need a client side certificate to use MQTTS.

If you want to test 8883, just change to MQTTS and test with test.mosquitto.org. If that works, but your local broker doesn't, that a pretty good indication that the local broker isn't configured correctly yet.

[trsimmons7]

You kinda lost me there (no surprise). 

I am using Mosquitto from Eclipse.

I refer to this page for the certificate requirements.

https://mosquitto.org/man/mosquitto-tls-7.html

That is describing how to use OpenSSL to generate certificates. When Mosquitto is configured for MQTTS on port 8883, the broker will need a certificate. We do not yet support client side certificates (that's coming), but you don't need a client side certificate to use MQTTS.

If you want to test 8883, just change to MQTTS and test with test.mosquitto.org. If that works, but your local broker doesn't, that a pretty good indication that the local broker isn't configured correctly yet.

So it seems like i can't use a self signed certificate? I mean the BRX is checking against a Certificate authority when the connection is opened?

[BobO]

For email, we embed the full certificate chain. For HTTPS and MQTTS we are essentially skipping the server certificate validation for now. Not sure how Mosquitto feels about self-signing. There are public free CAs out there though.