# Mosquttio tls works - but nodered needs no certificates?

**URL:** <https://discourse.nodered.org/t/mosquttio-tls-works-but-nodered-needs-no-certificates/71909>\
**Category:** General\
**Tags:** mqtt\
**Created:** [9 December 2022 10:02 UTC](https://discourse.nodered.org/t/mosquttio-tls-works-but-nodered-needs-no-certificates/71909 "2022-12-09T10:02:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![escapist3734](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@escapist3734](https://discourse.nodered.org/u/escapist3734)\
**Post date:** [9 December 2022 10:02 UTC](https://discourse.nodered.org/t/mosquttio-tls-works-but-nodered-needs-no-certificates/71909/1 "2022-12-09T10:02:35Z")

</div>

Hey

I've managed to implement tls on mosquitto broker. on CLI everything works fine.

I connect the broker to my nodered and ticked "TLS" but in the configuration I have NOT upload any certificate and it works!?  
 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/0/d/0d353c224a073a1feb1c1842b6d0e7127690a9b8.png)

my config from mosquitto:

```auto
# this will be replaces :)
allow_anonymous true

listener 8883
certfile /etc/letsencrypt/live/x.x.org/cert.p>
cafile /etc/letsencrypt/live/x.x.org/chain.pem
keyfile /etc/letsencrypt/live/x.x.org/privkey>

listener 8083
protocol websockets
certfile /etc/letsencrypt/live/x.x.org/cert.p>
cafile /etc/letsencrypt/live/x.x.org/chain.pem
keyfile /etc/letsencrypt/live/x.x.org/privkey>

require_certificate true

```

How can I test, if ssl is really enabled? Only with wireshark?  
What do I mixed up here?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [9 December 2022 13:07 UTC](https://discourse.nodered.org/t/mosquttio-tls-works-but-nodered-needs-no-certificates/71909/2 "2022-12-09T13:07:53Z")

</div>

> [@escapist3734](#):
>
> How can I test, if ssl is really enabled? Only with wireshark?

MQTTExplorer is very useful for this. Create 2 connections in it - 1 that uses TLS and the other that doesn't and see whether they both work.

---

<div class="post-metadata">

**Author:** ![escapist3734](https://avatars.discourse-cdn.com/v4/letter/e/4da419/32.png) [@escapist3734](https://discourse.nodered.org/u/escapist3734)\
**Post date:** [9 December 2022 14:23 UTC](https://discourse.nodered.org/t/mosquttio-tls-works-but-nodered-needs-no-certificates/71909/3 "2022-12-09T14:23:11Z")

</div>

Thanks for the reply.  
I've tested the szenario - and the conneciton with port1883 can't publish to the subscribe - so I think in this case this is good 😃

But - what about the node-red configuration - Is there no need for checking the server CA?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [9 December 2022 15:26 UTC](https://discourse.nodered.org/t/mosquttio-tls-works-but-nodered-needs-no-certificates/71909/4 "2022-12-09T15:26:58Z")

</div>

> [@escapist3734](#):
>
> Is there no need for checking the server CA?

No, because you are using a public PKI (Let's Encrypt). The root CA for this service is trusted in the OS cert stores on all OS's.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [23 December 2022 15:27 UTC](https://discourse.nodered.org/t/mosquttio-tls-works-but-nodered-needs-no-certificates/71909/5 "2022-12-23T15:27:19Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.