I'm troubleshooting making a TLS connection, and using openssl to do it. I'm unable to get the ARM computer (w/ Debian8) to connect to my server in GCP (mqtt:8883 to be exact). I generated self signed certificates on the server and installed them on the ARM computer, but it won't connect, clearly due to a certificate issue:
write:errno=104 --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 0 bytes and written 0 bytes
On a windows machine I install certificates and openssl connects (openssl from MinGW/msys) and also my Debian 8 VM on that windows machine. So I'm confident the server is setup correctly, and I do get the concept of installing the certificates. (oddly, when I delete the certificate files I added, it STILL works... must be some caching, would like to know to clear that)
On the ARM machine that won't work, I've tried manually specifying the path (-CApath) or file (-CAfile).
How do I verify what certificates openssl is trying? Does it look in subfolders?
Could it be because the certs are self signed? (why would it work on the other machines then?)
More information: I tried openssl verify on the certificates on the ARM machine (the self signed, and the server certificate):
:/etc/ssl# openssl verify ca_certificates/ca.crt ca_certificates/ca.crt: CN = An MQTT broker, O = OwnTracks.org, OU = generate-CA, emailAddress = firstname.lastname@example.org error 18 at 0 depth lookup:self signed certificate OK :/etc/ssl# openssl verify ca_certificates/server.crt ca_certificates/server.crt: CN = ########.com, O = OwnTracks.org, OU = generate-CA, emailAddress = email@example.com error 20 at 0 depth lookup:unable to get local issuer certificate