# MQTT node - can't use domain name

**URL:** <https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759>\
**Category:** General\
**Created:** [3 December 2019 21:16 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759 "2019-12-03T21:16:48Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [3 December 2019 21:16 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759/1 "2019-12-03T21:16:48Z")

</div>

I'm still struggling with setting up TLS with the node-RED MQTT node.....

**Broker**  
My broker is a Mosquitto server running on a Raspberry Pi at home. I've added a Mosquitto config file linking to the broker's Letsencrypt certs, as per @TotallyInformation's [draft guide](https://github.com/node-red/cookbook.nodered.org/pull/67/files?short_path=e7c2e46#diff-e7c2e4677c2c090a7342e46d06fe9175), and restarted the server.  
The config contains -

```auto
# Local MQTT
listener 1883
# Secure MQTT
listener 8883
## This is standard and should always be this
cafile /etc/ssl/certs/DST_Root_CA_X3.pem
## These are from your installation of LE
certfile /home/pi/.node-red/certs/fullchain.pem
keyfile /home/pi/.node-red/certs/privkey.pem
## Forces use of modern version of TLS to avoid security issues
tls_version tlsv1.2
## Force all clients in this listener to provide a valid certificate, change the node config to allow this from NR
#require_certificate true

```

..and netstat then shows the following -

```auto
pi@raspberrypi:~/.node-red $ sudo netstat -lptu | grep mosquitto
tcp 0 0 0.0.0.0:1883 0.0.0.0:* LISTEN 396/mosquitto
tcp 0 0 0.0.0.0:8883 0.0.0.0:* LISTEN 396/mosquitto
tcp6 0 0 [::]:1883 [::]:* LISTEN 396/mosquitto
tcp6 0 0 [::]:8883 [::]:* LISTEN 396/mosquitto

```

**Client**  
The client is node-RED running in a Oracle instance, and the connection is configured -

![mqtt-conf](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/1/1a3360879b5442f1f333b8daa1221db49a814ab4.jpeg)

The TLS config is -

![mqtt-conf](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/2X/0/0080d18629b288004c33e63b6c4ac875929e7afd.jpeg)

That seems to work, makes a connection to the broker, and I can subscribe to messages on the broker. BUT 2 problems...

1. If I change the node's Server IP address to `mqtts://mydomain.co.uk` or even `mqtts://mydomain.co.uk:8883` the node disconnects from the broker, and will not reconnect.
2. If I select 'Verify server certificate' then again the node disconnects from the broker.

I'm aware of [this git issue & pull request](https://github.com/node-red/node-red/issues/2379) that @skleeschulte raised, but not sure if it applies here.

I am not now using Cloudflare.

---

<div class="post-metadata">

**Author:** ![cymplecy](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/cymplecy/32/2773_2.png) [@cymplecy](https://discourse.nodered.org/u/cymplecy)\
**Post date:** [3 December 2019 21:31 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759/2 "2019-12-03T21:31:05Z")

</div>

Why are you trying mqtts://mydomain.co.uk why not just [mydomain.co.uk](http://mydomain.co.uk) ?

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [3 December 2019 21:33 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759/3 "2019-12-03T21:33:10Z")

</div>

I've tried - `mydomain.co.uk` & `https://mydomain.co.uk` and neither allows the client to connect to the broker.

---

<div class="post-metadata">

**Author:** ![cymplecy](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/cymplecy/32/2773_2.png) [@cymplecy](https://discourse.nodered.org/u/cymplecy)\
**Post date:** [3 December 2019 21:45 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759/4 "2019-12-03T21:45:50Z")

</div>

I've just read the instructions so I see why your trying them

From them, mqtts://mydomain.co.uk:8883 is the one Julian says to use so I'd just stick at trying that one so you don't get a double fault situation

---

<div class="post-metadata">

**Author:** ![cymplecy](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/cymplecy/32/2773_2.png) [@cymplecy](https://discourse.nodered.org/u/cymplecy)\
**Post date:** [3 December 2019 21:53 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759/5 "2019-12-03T21:53:21Z")

</div>

What's more puzzling is how you've managed to get it to work with the IP address as the instructions explicitly say that that LE certs need a domain name

Gonna need @TotallyInformation to help you out I think

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [3 December 2019 22:00 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759/6 "2019-12-03T22:00:19Z")

</div>

Thanks Simon, yes I had the same thoughts about using the IP address....  
I don't know who originally published the MQTT node, but it would be great to get some clarity about how it should be configured, or at least some meaningful documentation.

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [4 December 2019 10:01 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759/7 "2019-12-04T10:01:54Z")

</div>

Now sorted (at last!)  
The clue was in the last line of my initial thread post, because earlier that day I had moved over from my old server - which used Cloudflare as a proxy, and made my new local server live.  
This meant changing the DNS settings to point to my server, instead of Cloudflare.  
Later in the day, it appeared that the new DNS settings had propagated as I could then access the server. But it may have been that it had not propagated fully, and therefore upsetting the TLS connection.  
This morning, the connection is rock solid, and I have been able to fully add security to the settings.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [4 December 2019 10:56 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759/8 "2019-12-04T10:56:42Z")

</div>

> [@Paul-Reed](#):
>
> don't know who originally published the MQTT node

Nick & Dave I think.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [4 December 2019 10:57 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759/9 "2019-12-04T10:57:12Z")

</div>

> [@Paul-Reed](#):
>
> at least some meaningful documentation

I thought I'd done that 😉

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [4 December 2019 10:58 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759/10 "2019-12-04T10:58:32Z")

</div>

> [@Paul-Reed](#):
>
> Later in the day, it appeared that the new DNS settings had propagated as I could then access the server. But it may have been that it had not propagated fully, and therefore upsetting the TLS connection.

It can take quite a while for DNS changes to propagate - up to 48Hrs in some extreme cases.

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [4 December 2019 11:56 UTC](https://discourse.nodered.org/t/mqtt-node-cant-use-domain-name/18759/11 "2019-12-04T11:56:30Z")

</div>

> [@TotallyInformation](#):
>
> I thought I'd done that

Not quite! It only covers setting up the broker, and not the client.  
Also there are some other broker related issues that need adding.  
I'm going to update my earlier thread about setting up TLS with some more information later.