# Still being able to connect to broker after enabling require\_certificate **URL:** \ **Category:** Security\ **Created:** [July 24, 2021, 6:29pm UTC](https://forum.cedalo.com/t/still-being-able-to-connect-to-broker-after-enabling-require-certificate/284 "2021-07-24T18:29:17Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![fireFerry](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.cedalo.com/fireferry/32/343_2.png) [@fireFerry](https://forum.cedalo.com/u/fireFerry)\ **Post date:** [July 24, 2021, 6:29pm UTC](https://forum.cedalo.com/t/still-being-able-to-connect-to-broker-after-enabling-require-certificate/284/1 "2021-07-24T18:29:17Z")
Hello all, This is my first time trying to setup a MQTT broker using mosquitto. I’ve gone through the steps of creating certificates using this guide: [https://www.raspberrypi.org/forums/viewtopic.php?t=287326](https://www.raspberrypi.org/forums/viewtopic.php?t=287326) It all worked fine, but when adding require\_certificate true in the mosquitto config, I could still connect without using TLS. If I need to provide any more information, please tell so. ---
**Author:** ![roger.light](https://avatars.discourse-cdn.com/v4/letter/r/838e76/32.png) [@roger.light](https://forum.cedalo.com/u/roger.light)\ **Post date:** [July 26, 2021, 9:23am UTC](https://forum.cedalo.com/t/still-being-able-to-connect-to-broker-after-enabling-require-certificate/284/2 "2021-07-26T09:23:40Z")
Hi, It’s a pretty good overview on that page. I’ve just tested this myself and it worked exactly as I expected, so let me explain what I did so we can find out what is different. I’m using mosquitto 2.0.11, and I’m using certificates that are in the mosquitto repository so I don’t need to worry about generating them myself. The certificates are only useful when working on a single computer, but that’s fine here. My configuration file is: ```auto listener 8883 cafile test/ssl/all-ca.crt certfile test/ssl/server.crt keyfile test/ssl/server.key require_certificate true # To make testing a little simpler: allow_anonymous true ``` The certificates are in the `test/ssl` directory of the mosquitto source, I’m going to be running mosquitto from the root directory of the mosquitto source: ```auto cd /path/to/source mosquitto -c test.conf -v ``` Now I’ll try to connect with mosquitto\_sub. First without specifying our CA certificate (because we’re using port 8883, mosquitto\_sub will default to using TLS in version 2.0 and later, in earlier versions it would not use TLS unless explicitly told to). ```auto $ mosquitto_sub -p 8883 -t topic -d Client (null) sending CONNECT OpenSSL Error[0]: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed Error: A TLS error occurred. ``` As expected, the client rejected our custom certificate. Now trying with the CA certificate (which is at `test/ssl/all-ca.crt`): ```auto $ mosquitto_sub -p 8883 -t asdf -d --cafile test/ssl/all-ca.crt Client (null) sending CONNECT OpenSSL Error[0]: error:1409445C:SSL routines:ssl3_read_bytes:tlsv13 alert certificate required Error: The connection was lost. ``` This gives the error I’d expect - the server is rejecting the connection because the client isn’t providing a certificate. Now trying with a certificate: ```auto $ mosquitto_sub -p 8883 -t asdf -d --cafile test/ssl/all-ca.crt --cert test/ssl/client.crt --key test/ssl/client.key Client (null) sending CONNECT Client (null) received CONNACK (0) Client (null) sending SUBSCRIBE (Mid: 1, Topic: asdf, QoS: 0, Options: 0x00) Client (null) received SUBACK Subscribed (mid: 1): 0 ``` And it succeeds. Please take a look and see where your configuration differs. If there’s something that doesn’t make sense I’d be happy to hear about it so we can improve things for other people. Regards, Roger ---
**Author:** ![fireFerry](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.cedalo.com/fireferry/32/343_2.png) [@fireFerry](https://forum.cedalo.com/u/fireFerry)\ **Post date:** [August 17, 2021, 4:39pm UTC](https://forum.cedalo.com/t/still-being-able-to-connect-to-broker-after-enabling-require-certificate/284/3 "2021-08-17T16:39:17Z")
Hi, I’m very sorry for the late reply, this was because I was on vacation and unable to proceed. I’ve tried what you did, and it worked! Although I’m pretty new to the whole thing of setting up certificates, and there’s something I don’t quite understand. I’m trying to setup this broker for a project called [Owntracks](https://owntracks.org/). It’s a tool to share your location with other people, through the MQTT broker. In the app, to enable TLS, you need to specify the following: CA certificate, Client certificate, and Client certificate password. The first one I do understand, that’s the CA certificate which contains no sensitive information should be generating a CA certificate, which the mosquitto-tls manual tells you how to do. If I’m correct this should also be the `cafile` in the .conf file on the broker. Then on the manual, it creates a `server.key` file, creates a signing request, and the CA signs that request and the output is `server.crt`, the server certificate. So, `certfile` should be `server.crt`, and `keyfile` should be `server.key`. Then when moving to the client, basically the same thing happens as the steps with the server, first a key is made, then a signing request is made, then the CA signs it and the output is the client certificate. So I just need to put the `client.crt` file on the OwnTracks app (and the client certificate password being the optional password you can set), and then it should have a connection via TLS? Sorry for this large message, I just want to make sure I understand how it works, and make sure not to make any errors. Kind regards, fireFerry ---
**Author:** ![roger.light](https://avatars.discourse-cdn.com/v4/letter/r/838e76/32.png) [@roger.light](https://forum.cedalo.com/u/roger.light)\ **Post date:** [August 18, 2021, 2:06pm UTC](https://forum.cedalo.com/t/still-being-able-to-connect-to-broker-after-enabling-require-certificate/284/4 "2021-08-18T14:06:23Z")
Yes, your understanding is correct. Just to be extra clear, the CA certificate on the broker is used to verify the client certificates, and the CA certificate on the client is used to verify the broker certificates. They don’t actually need to be the same CA certificates. The owntracks project has a nice script that can generate certificates for you: [https://raw.githubusercontent.com/owntracks/tools/master/TLS/generate-CA.sh](https://raw.githubusercontent.com/owntracks/tools/master/TLS/generate-CA.sh) Regards, Roger