Support for CA certificate, i.e. to use test.mosquitto.org

[bentolor]

I want to connect to https://test.mosquitto.org/ using a client certificate for development purposes.

https://test.mosquitto.org/ssl explains how to create a client certificate for connection.

Unfortunately it seems mqttui is currently lacking an option to provide the certificate authority file to connect to port 8884 (MQTT, encrypted, client certificate required).

I wonder how others use this feature?

[EdJoPaTo]

Haven't looked far into this yet. Do I understand the issue correctly that --client-cert and --client-key exist, but are not enough for this use-case?

@boxmein Do you have thoughts here?

[bentolor]

@EdJoPaTo Yes! To ensure the client shows/exposes his key to the correct server, it needs to verify that it is talking to the server. I think currently this is achieved by assuming that the server certificate is signed by a CA which is known by the operating system? Not sure: I was unable to test.

Providing a server CA allows the client to verify it's talking to a valid signed server for all other cases (self-signed; CA not know to OS, …)

[alexg-axis]

I hit this issue just now and stumbled upon this issue. Proposed fix in #189. That said, for me --insecure still yields issues for me when connecting to a server with a self-signed certificate. I'm going to look into it.

[boxmein]

@EdJoPaTo should be simple enough to allow users to set their own desired CA certificate bundle path instead of loading roots from the OS around this place

mqttui/src/mqtt/encryption.rs

Lines 67 to 68 in 7ff1dd1

	let mut roots = rustls::RootCertStore::empty();
	let native_certs = rustls_native_certs::load_native_certs();

--insecure should help as a workaround though.

To specify client authentication (client cert + client key) the changes in #102 should be enough

[EdJoPaTo]

--insecure should still work, even without #189. Any ideas what might be missing there to ensure that is working as expected?

[bentolor]

@EdJoPaTo At least my credentials are production credentials used over the internet and I do not want to risk to expose them to an untrusted source. And I also want to test that I'm using the right CA. That's the whole point of a diagnostic tool. Insecure is literally just insecure, unless you work in a closed environment.

I don't understand the hesitation: @alexg-axis already contributed the implementation, the complexity of that implementation is incredibly low and mostly only seems to lack documentation, no?

[EdJoPaTo]

I think there is a misunderstanding, there should definitely be a secure way to connect. But at the same time, when a user wants to use --insecure it should work as expected. From past comments it sounded like that isn’t the case currently. As I currently have not as much time I haven’t checked this myself, just trying to advance the conversation here to keep things going. Especially as others have more experience there.
So that’s a different thing that came up and when there is something to fix, it should also be fixed.

Regarding the hesitation: I think it’s a good thing to add. But it should be done in a good way, thinking and working on it together. Also, this is still something done in the free time of me and in case of the PR alexg-axis so things will go on as fast as there is time to spare while having fun while doing so ;)

[EdJoPaTo]

When following https://test.mosquitto.org/ssl/ --insecure works as long as --client-cert and --client-private-key as supplied:

mqttui log --insecure --broker mqtts://test.mosquitto.org:8884 --verbose --client-cert client.crt --client-private-key client.key '$SYS/#'

Without --client-cert and --client-private-key: received fatal alert: CertificateRequired

Not sure whether --insecure can work without specifying them?

(Non --insecure behaviour does also seem to have issues, see #189 (comment))

[bentolor]

See the overview on https://test.mosquitto.org/ :

For ports 8883 and 8884 you should use the certificate authority file (mosquitto.org.crt (PEM format), or mosquitto.org.der (DER format)) to verify the server connection.

Don't get confused by the "client certificate" you provide vs. the "server certificate" aka. "certificate authority" or "CA": So the requirement of providing a client certificate is imposed by the server on that endpoint. But also the need to verify agains a custom, self-signed certificate authority (or "server certificate") not known to your OS.

Interestingly all the other encrypted ports seem to use a publicly known CA, which is why we do not need --insecure for connecting

mqttui log -b mqtts://test.mosquitto.org:8886 "$SYS/#"

but Port 8883 does require the custom CA but no client certificate:

mqttui --insecure log -b mqtts://test.mosquitto.org:8883 "$SYS/#"

[EdJoPaTo]

Ah, right, --insecure only handles connecting to an insecure server certificate. That works. Then in that connection the server rejects the client as it doesn't provide a client certificate.

So, --insecure works as it should?

[bentolor]

Yes, from my point of view --insecure works as it should.