0

I'm using paho.mqtt.c to connect in a "Self signed certificates" way to a MQTT broker. I have 3 files I use:

- CAfile.pem (CERTIFICATE)
- PrivateKey.pem (PRIVATE KEY)
- Certifcate.pem.crt (CERTIFICATE)

When CAfile.pem contin the last certificate in the chain.

When connecting using the below I get a "Verify return code: 0 (ok)":

openssl s_client -connect 1234.iot.eu-west-1.amazonaws.com:8883 
                 -cert Certifcate.pem.crt 
                 -key PrivateKey.pem 
                 -CAfile /etc/ssl/certs/ca-certificates.crt  #!!!!

When connecting using the below I get a "Verify return code: 20 (unable to get local issuer certificate)":

openssl s_client -connect 1234.iot.eu-west-1.amazonaws.com:8883 
                 -cert Certifcate.pem.crt 
                 -key PrivateKey.pem 
                 -CAfile CAfile.pem  #!!!!

I found out that the reason for the "Verify return code: 20..." is that Starfield Class 2 (that are in my ca-certificates.crt) is missing.

When I concat Starfield Class 2 to my 'CAfile.pem' it works.

Why the failure? How do I resolve it?

Improve this question
4
  • I'm not sure what you are asking here. You realized yourself that a required intermediate certificate is not send by the server and that adding it to the trust store helps. So you've already answered both why it fails and how it can be fixed. Also, I'm not sure how this relates to self-signed certificates since you are obviously not using a self-signed certificate for the server. – Steffen Ullrich Dec 13 '18 at 5:22
  • Your last comment is confusing for me. Your trust store is what you give with -CAfile. You say in your question that it works once you have added the missing certificate to the trust store which kind of implies that it wasn't in there before. – Steffen Ullrich Dec 13 '18 at 5:32
  • In -CAPath I pass the CAfile.pem, only one certificate, and it failes. When I change the -CAPath paramter to /etc/ssl/certs/ca-certificates.crt it works. When I concat the "Starfield Class 2" to "CAfile.pem" and use at in -CAPath it works. I do not understand why. – Noam M Dec 13 '18 at 5:36
  • 1
    This comment contradicts what you say in your question - where you claim that it fails with ca-certificates.crt and succeeds with CAfile.pem. Please fix your question to reflect the reality. Also, add what is exactly included in CAfile.pem since currently it is just the file you got without information about its contents. – Steffen Ullrich Dec 13 '18 at 5:41
1

It looks like that Starfield Class 2 CA is the root CA for the servers certificate. This root CA need to be included in the trust store. It is not fully clear what exactly CAfile.pem contains but from your description of "..contin the last certificate in the chain" I assume it is the server certificate and not the root CA. Since the server certificate is not a CA certificate at all it will simply be ignored when given in the -CAfile parameter since this - as the name suggests - expects CA certificates.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.