1

I am configuring emqtt MQTT Broker with SSL/TLS certificates from Digicert. I had done the SSL configuration for the same broker some years back and it was fine. But when I configured the new broker installation with new certificates, I am getting "unknown CA" error.

This is the SSL settings:

mqtt.listener.ssl.keyfile = etc/certs/prod.key 
mqtt.listener.ssl.certfile = etc/certs/server.crt
mqtt.listener.ssl.cacertfile = etc/certs/DigiCertCA.crt

And this is the error I saw in the server logs:

[error] <0.27032.0> SSL: certify: ssl_alert.erl:97:Fatal error: unknown ca

Can this be an issue with the new CA certifcate? Maybe it requires more dependent certificates in chain?

UPDATE This appears to be an OS issue.I got the following error when I tested the certificates using "openssl verify" in the server:

error 2 at 1 depth lookup:unable to get issuer certificate

Verify is success on my local PC with the same command and same certificates

I updated the OS root certificates using "yum update ca-certificates", but still I am getting the same error

Kiran G
  • 67
  • 1
  • 2
  • 8
  • Hi Kiran, Did you found the solution to this? even I am getting the same error. In my case also it was working fine but after updating the SSL certificate I am getting this error message. – Akash M May 28 '21 at 16:43
  • @AkashM please check my answer – Kiran G May 31 '21 at 03:54

1 Answers1

1

I found the root cause. Basically I had missed using one of the CA certificates in the chain. The CA certificate I had was not enough. So I appended the missing CA certificate to the CA file I was using. I just used 'cat' command for this.

Kiran G
  • 67
  • 1
  • 2
  • 8
  • If this solves a problem, please mark this as an "answer". – warchantua May 31 '21 at 07:13
  • Using this site I could easily get the intermediate certificate: https://tools.keycdn.com/certificate-chain – endo64 Aug 10 '22 at 10:36
  • For those non linux users could you elaborate more on the use of Cat cmd and file appends to make your answer more complete. – onxx Aug 15 '23 at 23:21