I don’t like asking for help since many questions are duplicates and @brocaar is a legend that has done way more than enough to make this an amazing solution but this is a thing I’ve been actively trying to do for more than 60 hours cumulatively and I’m becoming desperate so any help is highly appreciated.
At some point I gave up on TLS and wanted to do a sanity check so I spun up an MQTT server that doesn’t use TLS and confirmed that this entire setup of mine works perfectly without TLS, therefore confirming that the issues that I’m having are in regards to TLS.
I’m willing to regenerate my CA certificate and all the server certificates I used for my entire lab (2-3 day long process considering I’ll need to reconfigure all of my IoT devices, servers, services, and client devices) if that’s something that’s gonna help me make Chirpstack work.
Overview of my setup
- The whole lab is local only with all the devices being on my own network, so all certificates are self signed.
- MultiTech Conduit gateway with Chirpstack Gateway Bridge running on it.
- Mosquitto MQTT Broker running on my server, with my own self signed CA certificate and broker certificate. This server is only accessible from the local network. It doesn’t use client side certificates. It uses usernames and passwords as well as ACLs as everything is encrypted with TLS. This setup has been working great for 8+ years on more than 100 different devices (off-the-shelf as well as DIY).
- Chirpstack running in Docker (image: chirpstack/chirpstack:latest) along with Redis and Postgres.
- My CA certificate is generated as follows:
$ openssl genrsa -des3 -out rootCA.key 4096
$ openssl req -x509 -new -sha256 -key rootCA.key -days 3650 -out rootCA.crt
- The MQTT Broker TLS certificate is generated as follows:
$ openssl genrsa -out mosquitto.key 2048
$ openssl req -new -out mosquitto.csr -key mosquitto.key -sha256
$ openssl x509 -req -in mosquitto.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out mosquitto.crt -days 1800 -sha256
- This is my chirpstack.toml MQTT config:
[integration.mqtt]
event_topic="lorawan/application/{{application_id}}/device/{{dev_eui}}/event/{{event}}"
command_topic="lorawan/application/{{application_id}}/device/{{dev_eui}}/command/{{command}}"
json=true
server="ssl://$MQTT_BROKER_HOST:8883/"
username="redacted"
password="redacted"
qos=0
clean_session=false
client_id="chirpstack"
keep_alive_interval="30s"
ca_cert="/etc/chirpstack/certs/rootCA.crt"
tls_cert=""
tls_key=""
- This is my region MQTT config:
[regions.gateway]
force_gws_private=false
[regions.gateway.backend]
enabled="mqtt"
[regions.gateway.backend.mqtt]
event_topic="lorawan/gateway/+/event/+"
command_topic="lorawan/gateway/{{ gateway_id }}/command/{{ command }}"
server="ssl://$MQTT_BROKER_HOST:8883"
username="redacted"
password="redacted"
qos=0
clean_session=false
client_id="redacted"
keep_alive_interval="30s"
ca_cert="/etc/chirpstack/certs/rootCA.crt"
tls_cert=""
tls_key=""
- This is my Mosquitto MQTT Broker Configuration file:
persistence false
persistence_location /mosquitto/data/
log_dest file /mosquitto/log/mosquitto.log
log_dest topic
log_type error
log_type warning
log_type notice
#log_type information
connection_messages true
log_timestamp true
allow_anonymous false
password_file /mosquitto/config/mqtt_passwords
acl_file /mosquitto/config/mqtt_acl
listener 8883
cafile /mosquitto/config/certs/rootCA.crt
certfile /mosquitto/config/certs/mosquitto.crt
keyfile /mosquitto/config/certs/mosquitto.key
tls_version tlsv1.3 #I've tried tlsv1.1, tls1.2 and tls1.3
- I found out my CA was TLS v1, so I regenerated the CA certificate to be v3 but this didn’t help at all, as I’m getting the same issue as shown below.
The Issue
Whatever I do, I get the following error in my Docker (as well as on the gateway itself, but I assume that when the issue is resolved on docker, it’s going to be easy to get the gateway working as well):
ERROR chirpstack::gateway::backend::mqtt: MQTT error error=TLS: I/O: invalid peer certificate: Other(OtherError(UnsupportedCertVersion))
ERROR chirpstack::integration::mqtt: MQTT error error=TLS: I/O: invalid peer certificate: Other(OtherError(UnsupportedCertVersion))
