Where to download the SSL .crt flie while making SSL Connection in Windows?

[QwertyPoiuy]

Hello Gentlemen,
I am trying to test mymqtthub using mosquitto broker in my Windows machine, It works fine with normal TCP/IP Connection. But when I try to follow the steps shown in manual pages for SSL connection I am getting a message TLS error occured, Only then I figured out that the --capath mentioned is actually a directory in Linux. so where shall I download the .crt file to point to in Windows machine while making the SSL Connectoion

[francis.brosnan]

Hello,

See the following article. Even though it applies to MacOS/X is the same problem: mosquitto does not load system certfiicates when connecting to TLS/SSL:

Connecting to MyQttHub.com using mosquitto_sub/_pub and TLS from a MacOS/X

If you are attempting to connect using mosquitto_sub and mosquitto_pub from a MacOS/X using TLS (as described here: How to send and receive messages with mosquitto_sub and mosquitto_pub to MyQttHub.com) and it fails, keep reading. It seems mosquito support for MacOS/X to connect to TLS public systems it not ready out of the box. It is not an issue with mosquitto but due to the way MacOS/X handles certificates. Here you have a long description: In essence, MacOS/X stores root certificates u…

[QwertyPoiuy]

Hello Francis,
I understand that the certificates has to be placed in a temporary folder for proper functioning and openssl to understand, but where do i get the CA certificate and server certificate to initiate the SSL Connection to myqtthub

[anon79473925]

Did you see solution from mentioned article?

Connecting to MyQttHub.com using mosquitto_sub/_pub and TLS from a MacOS/X

2. How to solve it (workaround)

So the solution is to take the content of /etc/ssl/certs from a Linux machine (raspberry pi will do too), and place that content into /etc/ssl/certs or into a temporal folder pointed by your --capath command.

To connect to MyQttHub.com you just need public root certificates from known CAs (Certificate Authorities) to be available to mosquitto using --capath

This happens automatically for Linux stations because OpenSSL (the SSL library used by mosquitto) is configured in a way it loads certificates (usually) from /etc/ssl/certs where all public root CA certificates are made available by the OS distro maintainers.

That is, there is no such “CA certificate and server certificate to initiate the SSL connection to MyQttHub”.

Just regular publicly signed x509 SSL certificate and for that you need your software to have access to public root certificates.