I'm having some trouble with mqtt ssl example on esp-idf ESP32.

Example: mqtt_ssl

If I test it with the default broker "mqtts://mqtt.eclipse.org:8883" and default certificate "mqtt_eclipse_org.pem" It works correctly.

If I change the broker with mqtts://test.mosquitto.org:8883 ( https://test.mosquitto.org/ ) and change the certificate using (mosquitto.org.crt (PEM format), it fails and gave me TLS errors:

mbedtls:ssl_tls.c:5757 x509_verify_cert() returned -9984 (-0x2700)

esp-tls: mbedtls_ssl_handshake returned .0x2700
     esp-tls: Failed to verify peer certificate!
     failed to verify peer certificate
     verification info: ! the certificate is not correctly signed by the trusted CA

What am I doing wrong?

  • How/where did you get the certificate? You are supposed to provide the root certificate for the one used by the server you connect to. – jcaron May 16 at 11:27
  • I got it from test.mosquitto.org There was an error on the example config. But I got this error now: "verification info: ! The certificate is signed with an unacceptable key (eg bad curve, RSA too short)." – DDBE May 18 at 9:20
  • openssl x509 -in mosquitto.org.crt -text -noout shows RSA 1024, while openssl x509 -in mqtt_eclipse_org.pem -text -noout shows RSA 2048. So you need to find out whether the esp-idf supports certificates with 1024-bit RSA public keys. – geonnave May 18 at 17:30
  • Need to change this : rsa_min_bitlen in mbedtls_x509_crt_profile_default in x509_crt.c line 110 to 1024 and enabled #define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES in mbedtls/config.h line 3273. But this is not a good idea. Now I'm wondering why mosquitto has so weak certificate.. – DDBE May 19 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.