I am trying to connect an MQTT client to a server over MQTTS (MTTQ + TLS). The server provides 3 certificates:
- the cert of the MQTT endpoint,
- an intermediate certificate (RapidSSL) signed with GeoTrust Global CA
- a root cert used for cross certification (Equifax, with a weak SHA1 signature algorithm and due to expire in 2018)
Now, while everything works fine with browsers (i.e., they use the GeoTrust Global CA cert as the anchor instead of the Equifax cert), MQTT clients do not accept connecting when provided with the GeoTrust Global CA root, they only accept connecting with the deprecated Equifax root.
Note that the MQTT clients do not have a trust store, so we need to provide a public root certificate.
We tested with 2 different MQTT clients: mosquitto Embedded + WolfSSL on Marvel boards and mosquitto_sub on Linux
I suspect these clients might handle certificate chains differently but I'm not sure why/how.