# Mosquitto broker TLS stopped working after update to 2.0.10

**URL:** <https://forum.cedalo.com/t/mosquitto-broker-tls-stopped-working-after-update-to-2-0-10/519>\
**Category:** Security\
**Created:** [March 23, 2022, 6:39pm UTC](https://forum.cedalo.com/t/mosquitto-broker-tls-stopped-working-after-update-to-2-0-10/519 "2022-03-23T18:39:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![joba1](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.cedalo.com/joba1/32/444_2.png) [@joba1](https://forum.cedalo.com/u/joba1)\
**Post date:** [March 23, 2022, 6:39pm UTC](https://forum.cedalo.com/t/mosquitto-broker-tls-stopped-working-after-update-to-2-0-10/519/1 "2022-03-23T18:39:33Z")

</div>

Hi,

I have a mosquitto broker running fine for years on an opensuse server, including TLS.  
I recently upgraded from opensuse leap 15.2 to 15.3.  
Now I noticed the broker has stopped working and the reason is the TLS configuration.  
If I remove it, all works fine again.  
The configuration did not change during the update, only the broker version.

This is the error message I get:  
`Error: Unable to load server key file "/etc/letsencrypt/live/banzhaf.chickenkiller.com/privkey.pem". Check keyfile.`

Obviously I checked the key file:

- The user running the broker can read it
- start the command as root also fails
- using the key file and cert to communicate with openssl s\_client and s\_server commands shows the cert and key is valid

This is the opensuse rpm version:  
`mosquitto-2.0.10-bp153.1.1.x86_64`

**Is there a known bug in this version?**

Here is the tls config, nothing fancy:

```auto
listener 8883
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/letsencrypt/live/banzhaf.chickenkiller.com/fullchain.pem
keyfile /etc/letsencrypt/live/banzhaf.chickenkiller.com/privkey.pem
require_certificate true
use_identity_as_username true
use_username_as_clientid true

```

The start command is simply  
`/usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf`

Which contains just this line:  
`include_dir /etc/mosquitto/conf.d`

which contains the above tls config

Any idea how to get this going again?

---

<div class="post-metadata">

**Author:** ![roger.light](https://avatars.discourse-cdn.com/v4/letter/r/838e76/32.png) [@roger.light](https://forum.cedalo.com/u/roger.light)\
**Post date:** [March 23, 2022, 8:00pm UTC](https://forum.cedalo.com/t/mosquitto-broker-tls-stopped-working-after-update-to-2-0-10/519/2 "2022-03-23T20:00:45Z")

</div>

Hi joba,

Lets Encrypt certificates are not accessible to anything other than root, and since version 2 Mosquitto will not run as root when trying to read certificates.

We provide a Lets Encrypt renewal hook which will be run when new licenses are deployed by certbot. It can be used to automatically copy the new certificate and private key to an accessible location, set the required permissions, and signal the broker to reload the certificates. The script is at [mosquitto/mosquitto-copy.sh at master · eclipse/mosquitto · GitHub](https://github.com/eclipse/mosquitto/blob/master/misc/letsencrypt/mosquitto-copy.sh)

Let me know if you have any questions.

Regards,

Roger

---

<div class="post-metadata">

**Author:** ![joba1](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.cedalo.com/joba1/32/444_2.png) [@joba1](https://forum.cedalo.com/u/joba1)\
**Post date:** [March 23, 2022, 8:55pm UTC](https://forum.cedalo.com/t/mosquitto-broker-tls-stopped-working-after-update-to-2-0-10/519/3 "2022-03-23T20:55:47Z")

</div>

Thank you, this worked.

Anyways, I checked the ownership of the key file before and it was owned by group mosquitto that had read access (I did that). I could do a cat privkey.pem as user mosquitto without a problem. So I don’t understand, why it works now and what blocked access before. Strange…