mosquitto-clients and broker running on SSL

Question

我設法使用Let's Encrypt證書使用SSL設置代理。

我試過測試一個連接到wss://broker:9002/mqtt的websockets客戶端，它工作。我也嘗試使用mqtt.js命令行界面成功地訂閱經紀人mqtts://broker:8883/mqtt上的主題。

但是，我無法獲得mosquitto_sub和mosquitto_pub的工作。 我試着用，

$ mosquitto_sub -h www.my-host.com.ar -p 8883 -t hello -d --cafile fullchain.pem 
Client mosqsub/21069-atlantis sending CONNECT 
Error: A TLS error occurred. 

其中fullchain.pem是相同的CA證書這是在服務器上。

的mosquitto.log的經紀人顯示，

1456709201: OpenSSL Error: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca 
1456709201: OpenSSL Error: error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure 
1456709201: Socket error on client <unknown>, disconnecting. 
1456709206: New connection from <my-ip> on port 8883. 

可能是什麼回事？我沒有爲mqtt.js LIB提供任何證書......

這是我的經紀人配置（在兩個文件中分裂），

################################# 
# /etc/mosquitto/mosquitto.conf # 
################################# 
pid_file /var/run/mosquitto.pid 

persistence true 
persistence_location /var/lib/mosquitto/ 

log_dest file /var/log/mosquitto/mosquitto.log 

listener 1883 

listener 8883 
cafile /etc/letsencrypt/live/www.my-host.com.ar/fullchain.pem 
certfile /etc/letsencrypt/live/www.my-host.com.ar/cert.pem 
keyfile /etc/letsencrypt/live/www.my-host.com.ar/privkey.pem 

include_dir /etc/mosquitto/conf.d 

############################################# 
# /etc/mosquitto/conf.d/websockets_ssl.conf # 
############################################# 
listener 9002 
protocol websockets 
cafile /etc/letsencrypt/live/www.my-host.com.ar/fullchain.pem 
certfile /etc/letsencrypt/live/www.my-host.com.ar/cert.pem 
keyfile /etc/letsencrypt/live/www.my-host.com.ar/privkey.pem 

Answer 1

嘗試增加「--insecure」在mosquitto_sub的結束和mosquitto_pub命令。這允許客戶端繞過與證書主機名和遠程主機名相匹配的檢查。我必須用我生成的一些自簽名證書來做到這一點。

這裏是從 「--help」 這些命令的相關評論：

--insecure : do not check that the server certificate hostname matches the remote 
      hostname. Using this option means that you cannot be sure that the 
      remote host is the server you wish to connect to and so is insecure. 
      Do not use this option in a production environment.