Successfully Configuring MQTT with SSL on OpenHAB 3.2.0

General
1

Hello OpenHAB enthusiasts! I wanted to share my journey in configuring MQTT with SSL on my OpenHAB 3.2.0 setup. After encountering some initial challenges, I managed to get everything working smoothly. Here’s how I did it, in case anyone else is tackling the same issue.

Understanding the Challenge
Setting up MQTT with SSL can be a bit daunting for those new to the configuration process. I had the unencrypted MQTT working without issues, but adding SSL introduced a few hurdles. I realized that understanding the SSL certificate setup was crucial for securing my MQTT broker properly.

Step-by-Step Solution

  1. Certificate Authority Setup:
    I started by creating a Certificate Authority (CA) certificate and key. This involved using OpenSSL commands to generate the necessary files. Here’s the command I used:
    bash
    cd /etc/mosquitto/ca_certificates/
    sudo openssl req -new -x509 -days 400 -extensions v3_ca -subj ‘/C=FI/L=Some City/CN=192.168.1.140’ -keyout mosquitto-certificate-authority.key -out mosquitto-certificate-authority.crt

    This created the CA files needed for the SSL setup.

  2. TLS Configuration:
    Next, I generated the server certificate and key. This required creating a Certificate Signing Request (CSR) and then signing it with the CA. The commands were:
    bash
    cd /etc/mosquitto/certs/
    sudo openssl genrsa -out mqtt-server.key 2048
    sudo openssl req -new -out mqtt-server.csr -key mqtt-server.key -subj ‘/C=FI/L=Some City/CN=192.168.1.140’
    sudo openssl x509 -req -days 367 -CA …/ca_certificates/mosquitto-certificate-authority.crt -CAkey …/ca_certificates/mosquitto-certificate-authority.key -CAcreateserial -in mqtt-server.csr -out mqtt-server.crt

    These commands set up the server-side SSL certificates.

  3. Configuration File:
    I then created a new encryption configuration file at /etc/mosquitto/conf.d/encryption.conf and added the following lines to specify the SSL settings:
    plaintext
    port 8883
    cafile /etc/mosquitto/ca_certificates/mosquitto-certificate-authority.crt
    keyfile /etc/mosquitto/certs/mqtt-server.key
    certfile /etc/mosquitto/certs/mqtt-server.crt
    tls_version tlsv1.2

    This file tells Mosquitto to use SSL on port 8883.

  4. Restarting Mosquitto:
    After setting up the certificates and configuration, I restarted Mosquitto to apply the changes:
    bash
    sudo systemctl restart mosquitto

    It’s important to check the status of the service to ensure there are no errors:
    bash
    sudo systemctl status mosquitto.service

Testing the Configuration
Once everything was set up, I tested the connection using an MQTT client that supports SSL. I made sure to use the correct port (8883) and the client certificate for authentication. The connection was successful, and I could publish and subscribe to topics securely.

Troubleshooting Tips
If you encounter issues, here are some steps to take:

  • Check Logs: Look at the Mosquitto logs for error messages. This can provide clues about misconfigurations.
  • Verify Permissions: Ensure that the Mosquitto user has the correct permissions to access the certificate files.
  • Test Without SSL: Temporarily disable SSL to isolate whether the issue is with the SSL configuration or another part of the setup.

Conclusion
Configuring MQTT with SSL on OpenHAB was a rewarding experience. It not only enhanced the security of my setup but also deepened my understanding of SSL certificate management. If anyone else is working on this, I hope this guide helps you navigate the process smoothly. Happy automating!

If you have any questions or need further assistance, feel free to reach out. I’d be happy to help!