Mosquitto suddenly cannot load certificates

Help
22

Mosquitto 1.5.5, no changes have been made to mosquitto, on this installation using user root in config works with sudo mosquitto -c /etc/mosquitto/mosquitto.conf. I have carried out the same installation over and over and have not been able to resolve this. Why would this suddenly change is my issue. The installation process I have used for at least a year on multiple servers and only today it stops working.

23

This is a security risk, shifting the files is extra hassle, the problem is, why has this suddenly changed?

24

Was there a great deal of time between rollouts?

Are the versions of your ACME clients different between servers? (certbot --version)

What ACME client are you using? (This is critically important here.)

1 Like
25

I have installed at least 4 in the last few days, none of which had this issue. No versions are the same 0.31.0

26

Your certbot version is pretty old.

Is your OS Ubuntu?

Is your webserver apache?

Perhaps use a snap install to 1.9.0.

27

It is the one that is available in Ubuntu. It is downloaded from the repository each time. Also even moving the files does not make them able to be opened. No it is NGINX and I don't use snap.

29

This is nuts! Even after changing permissions in a non-root directory, still not able to read the certs:

Error: Unable to load CA certificates

31

The certs are symlinks.

certbot update_symlinks

1 Like
32

I found an issue on my side with that. One sec thanks for the help.

33

I had a wrong path in the cert config in mosquitto. OK so that is loading, but what happens when the certs are renewed, this will have to be manually updated.

34

Also the service still continues to fail.

35

Shouldn't. Go ahead and run the renewal with --force-renewal to check.

36

If you are the one making the change(s), how is this a risk?
Do you understand how it was working? And how it is now failing?

37

Changing the permissions of the folder means that users that are not suppose to access that folder will be able to. The certs will need moving every time they are updated.

38

Why? The symlinks solve that.

1 Like
39

I don't think that will "fix" anything.

40

It will check if the permissions and such get mangled.

1 Like
41

sudo cp /etc/letsencrypt/live/$domain/fullchain.pem /fserver/libraries/mosquitto/certs/

So the files in the new folder are symlinks pointing to the certs ? No they are the certs themselves.

42

This is an actual command to fix the symlinks:
certbot update_symlinks

1 Like
43

This makes no sense.
You control the server, you decide who has access to those files.
Sure, If you change permissions to "ANY ANY" then of course anyone can access them.
Do you understand how to set permissions so that only specific users have the access?