Feature Request: TLS support

[limpens]

Please add the possibility to use a TLS enabled broker.

[jziolkowski]

I'll look into it, thanks for the suggestion.

[ScrewLooseDan]

I agree this would be nice to have.

[jziolkowski]

I've added a test branch: tls

Please pull and test if TLS connection is working as expected.

[limpens]

Thank you for the changes.

• Looks like the selected certificate is not saved in the ~/TDM/tdm.cfg
• when selecting a ca-certificate as certificate (like: mosquitto_sub -h mqtt-server-fqdn -p 8883 -u mqtt-user -P mqtt-pass -t # -v --cafile /etc/mosquitto/ca_certificates/ca.crt) the broker reports a SSL error: OpenSSL Error: error:1408F10B:SSL routines:ssl3_get_record:wrong version number

Eric.

[jziolkowski]

Thanks for the input. The first error I'll look into it in a few mins.
I take it your certificate works with other clients?

[limpens]

Yes, that certificate works with a commandline mosquitto_sub like: mosquitto_sub -h mqtt.domain.tld -p 8883 -u mqtt-user -P mqtt-pass -t \# -v --cafile /etc/mosquitto/ca_certificates/ca.crt

…

On Tue, Feb 26, 2019 at 8:40 AM jziolkowski ***@***.***> wrote: Thanks for the input. The first error I'll look into it in a few mins. I take it your certificate works with other clients? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <https://github.com/jziolkowski/tdm/issues/9#issuecomment-467330580>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AtuBf1pzvph-yVCNKjeNm2JCaXG88v-nks5vROUKgaJpZM4bOcZn> .

[jziolkowski]

Ok. I've fixed cert path saving and pushed extra parameters for TSL. Please try.

[limpens]

Saving (and loading) of the selected certificated appears to be working fine. The TLS connection is not yet completing successfully though. Tried to change some of the parameters in self.mqtt.m_client.tls_set(), but no success on my end.

…

On Tue, Feb 26, 2019 at 8:57 AM jziolkowski ***@***.***> wrote: Ok. I've fixed cert path saving and pushed extra parameters for TSL. Please try. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <https://github.com/jziolkowski/tdm/issues/9#issuecomment-467335004>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AtuBf0n6RDl_Pn_2gigLpyueM36ZcXpJks5vROjqgaJpZM4bOcZn> .

[jziolkowski]

Same error?

[limpens]

Yes, this is the exact message in the mosquitto.log file: 1551171767: New connection from 192.168.10.254 on port 8883. 1551171767: OpenSSL Error: error:1408F10B:SSL routines:ssl3_get_record:wrong version number 1551171767: Socket error on client <unknown>, disconnecting. The same would happen when using mosquitto_sub without a ca certificate file.

…

On Tue, Feb 26, 2019 at 9:58 AM jziolkowski ***@***.***> wrote: Same error? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <https://github.com/jziolkowski/tdm/issues/9#issuecomment-467353678>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AtuBf4hQc4YmwnNF4nDxINuEUwEWv4_Xks5vRPcegaJpZM4bOcZn> .

[jziolkowski]

Ok, I'm getting more testers on board to check if it's an isolated issue or something with the implementation.

[jziolkowski]

Also, which python version are you using?

[limpens]

Python 3.6.7 and python3-paho-mqtt 1.3.1-1 (Ubuntu 18.04.2)

…

On Tue, Feb 26, 2019 at 10:30 AM jziolkowski ***@***.***> wrote: Also, which python version are you using? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <https://github.com/jziolkowski/tdm/issues/9#issuecomment-467364802>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AtuBfyTfhNhF7TviHa63RVZbcGBIgGR5ks5vRP69gaJpZM4bOcZn> .

[jziolkowski]

I've tried with my own server and the issue is quite complex. Related to openssl libs on the server, on the client, and these python ssl module was built against. I must put it on hold for now.

[Thomseeen]

Repository seems quite quiet, there is no ssl-branch anymore? Just came across this and might look into it myself if there is no solution yet.

[alexpilotti]

I'm using TLS and got it to work by just adding:

self.m_client.tls_set(ca_certs="/path/to/root.pem")

before:

tdm/Util/mqtt.py

Line 119 in 9b3edf5

self.m_client.connect(self.m_hostname,