MQTT error error=TLS: I/O: invalid peer certificate: Other(OtherError(UnsupportedCertVersion))

ChirpStack (v4) Integrations
1

Hi

I tested the MQTT integration with Chirpstack v4.90 and v4.60.

v4.60
Everything works fine with the TLS connection.

Oct 23 17:45:04 ODUv2-0003 chirpstack[203475]: 2024-10-23T09:45:04.672968Z  INFO chirpstack::integration::mqtt: Connecting to MQTT broker server_uri=ssl://xxx.xxx.xxx.xxx:8883 client_id=bd768c117e780f0b clean_session=false
Oct 23 17:45:05 ODUv2-0003 chirpstack[203475]: 2024-10-23T09:45:05.347532Z  INFO chirpstack::integration::mqtt: Connected to MQTT broker

v4.90
Got the “invalid peer certificate: Other(OtherError(UnsupportedCertVersion))” error message.
I’ve already used the x.509 v1/v3 certificates. Has anyone else encountered the same issue in v4.90?

Oct 23 18:50:27 ODUv2-0003 chirpstack[285568]: 2024-10-23T10:50:27.328705Z ERROR chirpstack::integration::mqtt: MQTT error error=TLS: I/O: invalid peer certificate: Other(OtherError(UnsupportedCertVersion))

Thanks.

2

Updated.

The server side also need to update the certificate to x.509 v3.
Now MQTT tls connection also works in v4.90.

i.e.

openssl genpkey -algorithm RSA -out server_x509v3.key -pkeyopt rsa_keygen_bits:2048
openssl req -new -key server_x509v3.key -out server_x509v3.csr
openssl x509 -req -in server_x509v3.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out server_x509v3.crt -days 3650 -sha256  -extfile v3.ext

# openssl x509 -in server_x509v3.crt -text -noout | grep Version
        Version: 3 (0x2)

Joey

3

Hey @joey, I’m still struggling with TLS for MQTT and I wanted to ask you if you could provide the v3.ext and .csr files you used? (with your private details redacted of course)
Edit: When I run your command openssl x509 -req -in server_x509v3.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out server_x509v3.crt -days 3650 -sha256 -extfile v3.ext, I get x509: Extra (unknown) options: "sha256 -extfile" "v3.ext"
Edit 2: Apparently when you copy the commands from the forum the dashes aren’t the same, so I just deleted and replaced them (even though they looked the same).