SSL in mqtt using mosquitto broker

Question

I am using MQTT mosquitto broker and using SSL certificate for authentication. I am facing issue like below, please check once.

java.io.IOException: unrecognised object: TRUSTED CERTIFICATE
at org.bouncycastle.openssl.PEMParser.readObject(Unknown Source)
at com.iot.mqtt.client.SslUtil.getSocketFactory(SslUtil.java:50)
at com.iot.mqtt.client.Publisher.start(Publisher.java:40)
at com.iot.mqtt.client.Publisher.main(Publisher.java:81)
MqttException (0) - javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at org.eclipse.paho.client.mqttv3.internal.ExceptionHelper.createMqttException(ExceptionHelper.java:34)
at org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:553)
at java.lang.Thread.run(Thread.java:745)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
at org.eclipse.paho.client.mqttv3.internal.SSLNetworkModule.start(SSLNetworkModule.java:84)
at org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:538)

The code i am using is below,

 private static final String caFile = "D:\\Srini_10568\\IOT\\Mosquitto\\ca.crt";
 private static final String caCrtFile = "D:\\Srini_10568\\IOT\\Mosquitto\\cacrt.crt";
 private static final String clientKeyFile = "D:\\Srini_10568\\IOT\\Mosquitto\\client.key";
public static final String BROKER_URL = "ssl://123.12.123.12:1883";
MqttConnectOptions options = new MqttConnectOptions();
        options.setCleanSession(false);
        options.setSocketFactory(SslUtil.
                getSocketFactory(caFile,caCrtFile, clientKeyFile, null));

SslUtil.getSocketFactory method has below code

reader = new PEMParser(new FileReader(crtFile));
        X509CertificateHolder certHolder = (X509CertificateHolder) reader.readObject();
        reader.close();

        X509Certificate cert = certificateConverter.getCertificate(certHolder);

score 0 · Answer 1 · answered Dec 22 '16 at 19:39

0

Probably your *.crt files have DER format. You can try to convert your certificate files to PEM format with online tool or use openssl.

openssl x509 -inform der -in certificate.cer -out certificate.pem

answered Dec 22 '16 at 19:39

Alexander Yanyshin

1,310
10
8

Its already in CRT format, there is no input format type for CRT in online tool – User12377777 Dec 22 '16 at 21:01

score 0 · Answer 2 · answered Dec 23 '16 at 14:25

If you are using SSL for client authentication, the CA file used in the server must contain all client certificates.

On the client side, the CA file contains the server's certificate.

In a scenario like yours you would have the following files:

server-key.pem
client{#}-key.pem
server-cert.pem
client{#}-cert.pem
server-ca.pem (contains all client{#}-cert.pem)
client{#}-ca.pem (contains server-cert.pem, basically a copy of it)

Where # is the client ID or number, if you will.

You can generate all the key/cert sets using:

Generating a 2048-bit RSA private key:

openssl genrsa -out <KEY-NAME>-key.pem 2048

Generating a CSR file from the private key:

openssl req -new -sha256 -key <KEY-NAME>-key.pem -out <CSR-NAME>-csr.pem -days <NUMBER-OF-DAYS>

Self-signing the CSR file and generating certificate:

openssl x509 -req -in <CSR-NAME>-csr.pem -signkey <KEY-NAME>-key.pem -out <CERTIFICATE-NAME>-cert.pem

Every time you generate a new client certificate you must dump its content in the server's CA so that the server can recognize it as a trusted device.

cat <CERTIFICATE-NAME>-cert.pem [<CERTIFICATE-NAME>-cert.pem] [...] > ca-cert.pem

I am not understanding is that problem with *.cer file or with my java code. I am using the code from here (https://gist.github.com/sharonbn/4104301) where he is doing the conversion from client.cer to X509CertificateHolder. But you are suggesting to look into certificate generation level. I am confused. — User12377777, Dec 23 '16 at 16:11
Are you using SSL for client authentication or only for secure data transmission? There is a difference there. Assuming the former, as you mentioned on your question, and looing into the link, the `cafile` in the server must contain `client.crt` and the `cafile` in the client must contain `server.crt`. — Hicaro, Dec 23 '16 at 16:58
It only for client auth as of now. I will check the availability of cafile in the server to have client.crt once. — User12377777, Dec 24 '16 at 00:50

score 0 · Answer 3 · answered Dec 27 '16 at 11:56

0

My issue is resolved. its issue with java library which is not identifying the cacrt.crt file begin string, once i removed the TRUSTED string it is working. Have fun.

answered Dec 27 '16 at 11:56

User12377777

145
2
20

score 0 · Answer 4 · answered May 17 '17 at 06:34

This is a bug in bouncy castle reported here : http://www.bouncycastle.org/jira/browse/BJA-475

It has been fixed in v1.51 released in july 2014, so you were probably using a really old version (more than 2 years) of bouncy castle.

Here is some sample code working with the most recent version of bouncy castle : https://gist.github.com/rohanag12/07ab7eb22556244e9698

score -1 · Accepted Answer · edited Dec 27 '16 at 12:37

-1

Good Catch!!!

Its seems java library is having limitation to recognize client certificate starting parameter :-

"-----BEGIN TRUSTED CERTIFICATE-----"

Hope next version will get the fix for this.

edited Dec 27 '16 at 12:37

Fabio

23,183
12
55
64

answered Dec 27 '16 at 12:24

Jitendra

14

Why is this the validated answer ? The error does not even comes from jdk, it comes from bouncy castle. – Tristan May 17 '17 at 06:10

SSL in mqtt using mosquitto broker

5 Answers5