# MQTT component : don't support TLS 1.2?

**URL:** <https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464>\
**Category:** General\
**Created:** [17 June 2020 10:54 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464 "2020-06-17T10:54:06Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![vp2021](https://avatars.discourse-cdn.com/v4/letter/v/5fc32e/32.png) [@vp2021](https://discourse.nodered.org/u/vp2021)\
**Post date:** [17 June 2020 10:54 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/1 "2020-06-17T10:54:06Z")

</div>

Hello,

I want to use the basic component in Node-Red "MQTT IN" and "MQTT OUT" to connect to a RabbitMQ broker securely (TLS 1.2).

I see by analyzing the frames with "Wireshark" that Node-Red communicates in TLS 1.0, which is old. Is there a way to work in TLS 1.2 with Node-Red?

Thank you!

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [17 June 2020 11:10 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/2 "2020-06-17T11:10:01Z")

</div>

What version of node.js are you using? This isn't something we explicitly set in the node and let the underlying tls layer negotiate with the remote server its connecting to.

---

<div class="post-metadata">

**Author:** ![vp2021](https://avatars.discourse-cdn.com/v4/letter/v/5fc32e/32.png) [@vp2021](https://discourse.nodered.org/u/vp2021)\
**Post date:** [17 June 2020 11:13 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/3 "2020-06-17T11:13:47Z")

</div>

I use :  
17 Jun 10:59:46 - [info] Node-RED version: v1.0.6  
17 Jun 10:59:46 - [info] Node.js version: v12.18.0

And I need to connect to RabbitMQ in TLS 1.2

You're saying we can't force TLS 1.2?

Thanks.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [17 June 2020 11:25 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/4 "2020-06-17T11:25:02Z")

</div>

We don't expose any option to force the client to use a particular TLS version. As I understand it, it will negotiate with the server to find a mutually available version.

Looking at the [documentation for the node.js tls module](https://nodejs.org/api/tls.html#tls_tls_default_min_version), the default minimum TLS version is already set to `TLSv1.2` - so it should be using that if both client and server support it.

Have you verified you can create a TLS 1.2 connection to your RabbitMQ server from another client?

We could certainly add some other options to the TLS Config node in node-red, but given the above, I'm not sure it would help.

---

<div class="post-metadata">

**Author:** ![vp2021](https://avatars.discourse-cdn.com/v4/letter/v/5fc32e/32.png) [@vp2021](https://discourse.nodered.org/u/vp2021)\
**Post date:** [17 June 2020 11:49 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/5 "2020-06-17T11:49:59Z")

</div>

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/2/a/2a99e6d47c13270dac5e0742e86b853b68ff6b10.jpeg)

Thank you for your response.

With Wireshark analyzing the packets I find the following:

- When I use the "MQTT Explorer" client to test the connection, it works in TLS 1.2

-When then I use Node-Red, Node-RED tries to connect to TLS 1.0

If MQTT Explorer is able to negotiate a TLS 1.2 connection, Node-Red could do so too.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [17 June 2020 12:49 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/6 "2020-06-17T12:49:28Z")

</div>

Ok - so we know the server supports 1.2.

Given you're using Node 12, which has `tls.DEFAULT_MIN_VERSION` set to TLS 1.2 already, I don't know why its connecting with 1.0. Based on the node.js docs, I don't think it should be doing that at all -there's no code in the MQTT node that modifies the TLS min version.

So I don't know why it's doing that.

---

<div class="post-metadata">

**Author:** ![ristomatti](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ristomatti/32/5857_2.png) [@ristomatti](https://discourse.nodered.org/u/ristomatti)\
**Post date:** [17 June 2020 18:06 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/7 "2020-06-17T18:06:54Z")

</div>

I thought Node-RED was using MQTT.js? Could it be the "bottleneck"?

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [17 June 2020 20:05 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/8 "2020-06-17T20:05:35Z")

</div>

Could be - node-red locks on to MQTT.js V2.18.8 - thats from 2y ago - current version in NPM is 4.1.0

node-red package.json  
`"mqtt": "2.18.8",`

Not 100% sure that would be the reason for TLS 1.0 though.

### EDIT...

Rather than just a throw away comment - I am gonna do a quick test to see what happens (from a compatibility / usability POV) if we force node-red to use V3.0.0 or V4.1.0 - then I'll feedback how to do it for @vp2021 to test if that fixes the TLS neg issue

I seem to remember on a non node-red project I simply replaced MQTT.js without issue.

### END EDIT
  

* * *

### \_\_(slightly off topic) \_\_

#### While on the subject of MQTT - would be nice to see some of MQTT v5 goodness in node red - in particular...

- User Properties
- Payload Format Indicator & Content Type
- Response Topic and Request /Response Pattern

... though I have no idea how they would look/fit together in node-red land

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [17 June 2020 22:24 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/9 "2020-06-17T22:24:06Z")

</div>

> [@Steve-Mcl](#):
>
> While on the subject of MQTT - would be nice to see some of MQTT v5 goodness in node red - in particular...

Yes, off topic - let's not change the subject, if you want to discuss v5 support in the core please start a new topic. Of course I'm well aware of this (I'm on the MQTT standards technical committee). But so far, no-one has offered to do all the work needed, so it sits in the backlog.

---

<div class="post-metadata">

**Author:** ![vp2021](https://avatars.discourse-cdn.com/v4/letter/v/5fc32e/32.png) [@vp2021](https://discourse.nodered.org/u/vp2021)\
**Post date:** [18 June 2020 12:53 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/10 "2020-06-18T12:53:48Z")

</div>

I've got news!

I managed to connect to RabbitMQ with the MQTT component of [cloud.iO](http://cloud.iO). But there's something weird about it.

My problem is still with Debian10. But last night I tried with Ubuntu 20.04 LTS and managed to connect to the Broker.

Debian 10 :  
RED Node: 1.0.6  
Node.js: 12.18.0  
OpenSSL: 1.1.1g (21.04.2020) (Library: OpenSSL 1.1.1d 10 Sep 2019)

Wireshark on Debian :

 ![debian](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/8/3/8379245d936b5669e6ab768fff1867ac51a8e05d.jpeg)

Ubuntu 20.04 LTS :  
RED Node: 1.0.6  
Node.js: 12.18.1  
OpenSSL: 1.1.1f (31.03. 2020)

Wireshark on Ubuntu:

 ![ubuntu2](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/5/0/50db42808c26f16a92ada5565ef5e823abc12c28.jpeg)

I wonder if the version of openSSL on Debian is too old?

---

<div class="post-metadata">

**Author:** ![ristomatti](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ristomatti/32/5857_2.png) [@ristomatti](https://discourse.nodered.org/u/ristomatti)\
**Post date:** [18 June 2020 13:04 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/11 "2020-06-18T13:04:32Z")

</div>

> [@vp2021](#):
>
> I wonder if the version of openSSL on Debian is too old?

Very strange indeed but definitely not the OpenSSL version since TLS 1.2 support was added already in 2012: [tls1.2 - When was TLS 1.2 support added to OpenSSL? - Stack Overflow](https://stackoverflow.com/questions/48178052/when-was-tls-1-2-support-added-to-openssl)

Maybe some issue with the networking stack or a difference in firewall configuration or Linux kernel version (support for your network interface)?

---

<div class="post-metadata">

**Author:** ![vp2021](https://avatars.discourse-cdn.com/v4/letter/v/5fc32e/32.png) [@vp2021](https://discourse.nodered.org/u/vp2021)\
**Post date:** [19 June 2020 07:42 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/12 "2020-06-19T07:42:28Z")

</div>

Hi,  
I have the solution :  
You need to change the minimum version of TLS in the openSSL configuration file :  
MinProtocol = TLSv1.0 instead of TLSv1.2

![2020-06-19_093413](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/9/5/95f3d10fc2debe9864c60468d0469ed2727e4fbe.jpeg)

And restart Node-Red after that.

From now on, the negotiation of the version of TLS used will be done in v1.0, and everything else in 1.2.

Have a nice day!

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [19 June 2020 08:16 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/13 "2020-06-19T08:16:27Z")

</div>

That's kind of backwards isn't it :-)... If I say I want min 1.2 it fails to negotiate and uses 1.0...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [3 July 2020 08:16 UTC](https://discourse.nodered.org/t/mqtt-component-dont-support-tls-1-2/28464/14 "2020-07-03T08:16:30Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.