Is enable_server_cert_auth same as insecure?

1

Is enable_server_cert_auth same as --insecure?

let ssl_opt: SslOptions = SslOptionsBuilder::new()
        .ca_path("ca.crt")
        .map_err(|e| error!("Mqtt ssl fail: {}", e))
        .unwrap()
        .enable_server_cert_auth(false) <-- here
        .finalize();

Is this equivalent to mosquitto_sub --insecure --cafile ca.crt -h mqtt.example.com -p 8883?

Thanks

2

--insecure disables checking if the hostname in the certificate matches. Based on the man page, it seems like it still checks if a valid certificate trusted by the given CA is used.

I don't know from which crate SslOptions originates, but the name enable_server_cert_auth seems to suggest it also disables verifying that the certificate is trusted by the given CA.

3

@bjorn3 Thanks

I created self signed certificate by openssl but I put the host name there.
However it is still not connecting when its enable_server_cert_auth(true), but when its false everything is fine & working.

4

Please check the host with

to find what's wrong with the certificate it uses, and fix the HTTPS connection, instead of disabling security entirely.

Disabling anything about the verification is always insecure, and allows MITM attacks.

There's no difference between allowing wrong hostname from a correct CA or allowing any invalid certificate. Valid CA-signed domain certificates can be obtained automatically for free by anybody, so the hostname check is the crucial thing required for security.

2 Likes
5

@kornel Thanks

That is absolutely correct.

Confusion is this command working.

mosquitto_sub -h mqtt.example.com -p 8883 -u user -P pass -t '#' --cafile ca.crt -d

While mqtt paho for rust not working.

let ssl_opt: SslOptions = SslOptionsBuilder::new()
        .ca_path("/path/to/ca.crt")
        .map_err(|e| error!("Mqtt ca.crt error: {}", e))
        .unwrap()
        .finalize()

Error
[-1] TCP/TLS connect failure

6

The docs say ca_path is a directory and it looks for .pem files there.

1 Like
7

@kornel Thanks a lot.

Changing from ca_path to trust_store resolved the issue.

8

This topic was automatically closed 90 days after the last reply. We invite you to open a new topic if you have further questions or comments.