Skip to content
Start free evaluation

TLS problems

TLS errors happen during the handshake, before any MQTT CONNECT is sent. The client output is terse, so read it together with the OpenSSL message in the broker log. Examples use the file names from Connect through a TLS broker.

The simulator and TLS

Section titled “The simulator and TLS”

The PDComm simulator connects to the broker over plain TCP. Connecting it to a TLS listener gives these errors:

Where Message
Simulator MQTT broker connection failed: MQTT transport I/O: ConnectionReset
Broker log OpenSSL Error while trying to get the error[0]: error:0A00010B:SSL routines::wrong version number

Connect the simulator to a plain listener and let a broker bridge carry the TLS leg.

Causes by message

Section titled “Causes by message”
Client output Broker log Cause Fix
Error: Protocol error tlsv1 alert unknown ca The client doesn’t trust the CA that issued the broker certificate. On port 8883 without --cafile, the client uses the operating system’s trust store, which doesn’t know your own CA. Pass the issuing CA with --cafile ca.crt.
Error: Protocol error tls alert bad certificate The subjectAltName of the broker certificate doesn’t contain the host name or IP address you connected to. Reissue the certificate for that name or address, or connect with a name the certificate contains.
Error: The connection was lost peer did not return a certificate The broker requires a client certificate (require_certificate true), and the client sent none. Pass --cert and --key.

Run mosquitto_sub -d to see the client-side OpenSSL message as well. An untrusted CA or a name mismatch prints:

OpenSSL Error while trying to get the error[0]: error:0A000086:SSL routines::certificate verify failed

Bridge errors

Section titled “Bridge errors”

When the edge broker’s bridge can’t connect to the site, the edge log repeats lines like these, with a different wait each time:

OpenSSL Error while trying to get the error[0]: error:0A000086:SSL routines::certificate verify failed
Client local.pdcomm-edge-bridge [(null):0] disconnected: bad socket read/write: A TLS error occurred
Bridge site next backoff will be 5193 ms
Check Setting
The CA that issued the site certificate bridge_cafile
An address listed in the site certificate’s subjectAltName address
A bridge certificate issued by a CA the site trusts bridge_certfile, bridge_keyfile

The reason after disconnected: can also read Protocol error.; the line that matters is certificate verify failed before it.

Once the bridge connects, the site log shows it, for example as pdcomm-edge-bridge (p5, c0, k60, u'pdcomm-edge').

Narrow it down with openssl

Section titled “Narrow it down with openssl”

Testing TLS alone with openssl s_client instead of an MQTT tool gives you the verification failure as a number:

터미널 창
openssl s_client -connect 127.0.0.1:8883 -CAfile ca.crt -cert operator.crt -key operator.key \
  -verify_ip 127.0.0.1 -verify_return_error -brief < /dev/null
Output Meaning
CONNECTION ESTABLISHED, Protocol version: TLSv1.3 TLS is fine; the problem lies in MQTT authentication or permissions.
verify error:num=19:self-signed certificate in certificate chain The CA in -CAfile didn’t issue the broker certificate.
verify error:num=64:IP address mismatch The certificate’s subjectAltName lacks that IP address. For a host name, use -verify_hostname.

Inspect a certificate with openssl x509:

터미널 창
openssl x509 -in site.crt -noout -ext subjectAltName
openssl x509 -in site.crt -noout -enddate
X509v3 Subject Alternative Name:
    DNS:localhost, IP Address:127.0.0.1
notAfter=Oct 14 17:14:30 2027 GMT

A certificate past its notAfter date fails verification. Replace it with a new one before it expires, and restart the broker.

Privacy Policy