wss connection in web_mqtt

[carlosdomenje]

Hello everyone, I am implementing an mqtt broker and I need to connect to my web client through wss. The problem is that the web client that is developed in Flutter Web does not have a context where it can attach the client certificates. Yes, I can do it if I compile for iOS or Android since Flutter supports the context where I can attach the certificates and it works perfectly.

I currently have this setup in my rabbitmq.conf

ssl_options.cacertfile = /etc/rabbitmq/cert/ca_certificate.pem
ssl_options.certfile = /etc/rabbitmq/cert/server_certificate.pem
ssl_options.keyfile = /etc/rabbitmq/cert/server_key.pem
ssl_options.verify = verify_none
ssl_options.fail_if_no_peer_cert = false
ssl_options.password = my-pass
ssl_options.versions.1 = tlsv1.3
ssl_options.versions.2 = tlsv1.2
web_mqtt.ssl.port = 15676
web_mqtt.ssl.cacertfile = /etc/rabbitmq/web_cert/ca_certificate.pem
web_mqtt.ssl.certfile = /etc/rabbitmq/web_cert/server_certificate.pem
web_mqtt.ssl.keyfile = /etc/rabbitmq/web_cert/server_key.pem
web_mqtt.ssl.password = my-pass
mqtt.listeners.ssl.default = 8884
listeners.ssl.default = 5671
mqtt.listeners.tcp = none
loopback_users = none
default_user = my-user
default_pass = pass
mqtt.default_user = my-user
mqtt.default_pass = pass
mqtt.allow_anonymous = false

If I connect with an mqtt client made in node.js where I can attach the certificates, the connection is successful.

mqtt-server | 2022-01-23 22:31:15.306744+00:00 [info] <0.896.0> accepting MQTT connection <0.896.0> (192.160.90.1:5333 -> 192.163.94.6:8884, client id: mqttjs_40958857)

But if I want to connect from the web client developed in Flutter Web, where I can't attach the certificates I get this error.

mqtt-server | 2022-01-23 22:31:35.869055+00:00 [noti] <0.944.0> TLS server: In state wait_finished received CLIENT ALERT: Fatal - Certificate Unknown

should the options ssl_options.verify = verify_none and ssl_options.fail_if_no_peer_cert = false not let me connect to the broker without certificates?

In the Flutter application I have this function to connect.
final mqttClient = MqttBrowserClient( 'wss://my-dns/ws', '');

The output is this

main.dart.js:7430 WebSocket connection to 'wss://my-dns:15676/ws' failed:
main.dart.js:88239 WebSocket is already in CLOSING or CLOSED state.

On the other hand, if I want to make the connection with the web client through websockets on port 15675 and without wss, the client works perfectly on the web, but when I am in production and in an https connection, I have an error with the connection to through ws since it is not secure and it asks me to implement a wss connection.

The concrete question is if I can connect with wss:// without providing certificates in the web client. Is there a way to establish the connection or does rabbitmq not allow it and the client must always attach the client certificates?

I hope you can help me.

[lukebakken]

should the options ssl_options.verify = verify_none and ssl_options.fail_if_no_peer_cert = false not let me connect to the broker without certificates?

With those settings in place RabbitMQ will not require certificates. CLIENT ALERT: Fatal - Certificate Unknown suggests that your client is still trying to present certificates, perhaps.

Is there a way to establish the connection or does rabbitmq not allow it and the client must always attach the client certificates?

Yes there is. Your "Flutter" application must have a bug or something is not described correctly here.

The easiest way for us to assist would be for you to provide an application I can run to reproduce the issue.

[carlosdomenje]

Hi lukebakken, thank you for your answer. Here is a link that have the example i'm trying to run with wss. There is not options where attach the client certificate so i don't know why I have this error.

mqtt_wss_example

As the library suggests, for secure connections i have to use wss, but without client certificates.

Please tell me if this is enough for you or need another implementation.

Thank you so much.

[lukebakken]

How do I run that code? Will it run as-is without modification against a RabbitMQ broker running on localhost? Please make this process as simple as possible. I don't have the time to try to figure out how to run things, only time to reproduce issues!

[carlosdomenje]

Sorry but you must have to install Flutter framework and compile the example for web... I understand that only you have time for reproduce issues, so i will continue with some test. My main question was answered and that is if options ssl_options.verify = verify_none and ssl_options.fail_if_no_peer_cert = false the client could connect to broker without certificates.

Thank you.

[lukebakken]

Right, if you could provide a repository that I could clone and run make or a script to get everything set up that would be extremely helpful and I would most likely be able to reproduce the issue.

I would like to see the issue because there is something not quite right here. It should work.

[lukebakken]

@carlosdomenje I took our Web MQTT sample code and added RabbitMQ configuration and certs here:

https://github.com/lukebakken/rabbitmq-server-4027

Using the echo.html page I can reproduce the error you report:

2022-01-25 14:50:13.088000-08:00 [notice] <0.975.0> TLS server: In state wait_finished received CLIENT ALERT: Fatal - Unknown CA

What's interesting is that I do not get that message if I run openssl to test the TLS handshake:

C:\Users\bakkenl\development\lukebakken\rabbitmq-server-4027 [main ≡]> openssl s_client -connect localhost:15676 -CAfile ./certs/ca_certificate.pem -verify 8 -verify_hostname bakkenl-z01
verify depth is 8
CONNECTED(000000A8)
Can't use SSL_get_servername
depth=1 CN = TLSGenSelfSignedtRootCA, L = $$$$
verify return:1
depth=0 CN = bakkenl-z01, O = server
verify return:1
---
Certificate chain
 0 s:CN = bakkenl-z01, O = server
   i:CN = TLSGenSelfSignedtRootCA, L = $$$$
 1 s:CN = TLSGenSelfSignedtRootCA, L = $$$$
   i:CN = TLSGenSelfSignedtRootCA, L = $$$$
---
Server certificate
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
subject=CN = bakkenl-z01, O = server

issuer=CN = TLSGenSelfSignedtRootCA, L = $$$$

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2301 bytes and written 373 bytes
Verification: OK
Verified peername: bakkenl-z01
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

I will keep investigating. Feel free to check out the repository I made.

[lukebakken]

@carlosdomenje my guess is that you are using self-signed certificates like I am. You must import the CA certificate into your browser or your local CA certificate store, and your code will work. I was testing with firefox and the "Certificate" settings allow me to import the cacertfile file as a trusted root.

After trusting that file TLS connections worked.

Please let me know if that resolves your issue.

[carlosdomenje]

Hi @lukebakken, thank you for this test. As you say, i am using self-signed certificates. I have to investigate how to import CA certificates into my app but your test let me know that broker works with this configuration. I will keep reading your github test and try to apply into my project and then write the results.

[lukebakken]

For production use you should not use self-signed certificates for RabbitMQ. Get a "real" certificate signed by one of the trusted authorities and you won't have this issue.