2

I run c# MQTT broker (in socket not websocket) with self signed certification for TLS in cloud server and now client cant connect to server and get this error message

The remote certificate was rejected by the provided RemoteCertificateValidationCallback

Is possible MQTT broker use self signed certification?
What is best practice of using TLS certificate ?

3 Answers 3

3

The point of a certificate is that one endpoint can be sure that the other endpoint is who they say they are, and not somebody else.

In the most common case, it is the client which checks that the server presents a valid certificate matching the domain name they connected to, for which the server has the associated private key, and which the client can trace back to someone they trust.

So if you connect to example.com, the server should have a certificate for example.com, with the matching private key, and this certificate needs to be signed by someone they trust.

The default "trust" of browsers and most other clients is a list of root certificates which belong the certificate authorities (CAs) which have been vetted against criteria chosen by the CA/Browser forum. It involves a lot of rules on how they check domain ownership (and possibly other criteria for OV or EV certificates), security, audits, revocation, etc.

CAs which match these criteria are usually included in root certificate stores, either in the OS (Windows, macOS, various Unix distributions...) or the browser (Firefox, most others rely on the OS).

If the certificate of example.com is signed by one of those CAs, then it is trusted. If not (as in the case of a self-signed cert), then it isn't.

If you want your web site to be available to everyone, they you don't have much choice than getting a certificate from one of those CAs.

If on the other hand you control all the client devices, then you can either add the certificate to the trusted certificate store of all those clients.

The alternative is to allow insecure connections (not check if the certificate is trusted), but the end result is that... it's insecure!

2

I assume this is linked to this SO question.

You need to look at what you are trying to achieve here.

A broker can user a self signed certificate to identify it's self as long as the clients all have a copy of that certificate to verify it against.

Using a self signed certificate for a client doesn't make much sense because the broker would need to keep a list of ALL the different client certificates to check any incoming connection against. Where as if all the client certificates are signed by one CA certificate then the broker only needs a copy of the CA cert to validate ALL the client certificates.

If you use the same CA cert to sign the brokers certificate then it all gets easier as well. Be aware that x509 certificates can have different flags which can add/remove properties that are used to distinguish between a certificate to identify a server(broker) or a client. e.g. Server certificates should have SAN entries that match the hostname/IP address the client uses to connect to the broker.

Running your own CA is pretty simple and there a many examples of how to do it with openssl online.

4
  • Is buying certificate better way or using self signed for server ?
    – behroozbc
    Oct 20, 2021 at 14:01
  • 1
    We can't answer that, it totally depends on details specific to your deployment
    – hardillb
    Oct 20, 2021 at 14:11
  • when I use self signed certificate for http request browser show me unsafe error is in mqtt client same thing happened ? and certificate Issuer is not valid client cannot connect to broker ?
    – behroozbc
    Oct 20, 2021 at 14:15
  • Again we can't answer that, we have no idea how you've set the broker and client up. It's up to you to decide the risk profile for your project and how it will be built and distributed (e.g. if you can ship a ca cert with the client or if it needs to use the trusted CA bundle that suits baked into either the OS or any framework (browser) you may be using. There isn't enough information in this question (or in the SO question) to say more
    – hardillb
    Oct 20, 2021 at 15:32
2

I think you may be mistaking self-signed certificates with free (automatic) certificates signed by a Certificate Authority.

If you want to have a secure connection between a server (MQTT broker) and a client you do need a certificate. Self-signed certificate makes sense only in a few cases like:

  • testing purposes
  • having only a small group of clients that does not change often
  • having it all running only inside a local network, not internet

In the second case every client would need to have a the server certificate known and trusted prior to connecting to the server. I guess that would be the case if all the clients would be your own devices or devices of your friends. But even in that case, I wouldn't recommend a self-signed certificate.

What would be probably much easier, especially in the long run is to have an "official" certificate signed by a Certificate Authority like Let's Encrypt which is free and automatic. And really easy. This way all the new random clients from the web can trust your MQTT broker to really be the one they are looking for.

Also, as far as I understand, the error you can is not from the configuration of the server but the configuration of the client. The client is configured to not trust a self-signed certificate. If you want to continue using a self-signed certificate you should reconfigure your client software to trust it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.