# MQTT SSL/TLS connection
**URL:** https://discourse.nodered.org/t/mqtt-ssl-tls-connection/16156
**Category:** General
**Created:** [1 October 2019 14:43 UTC](https://discourse.nodered.org/t/mqtt-ssl-tls-connection/16156 "2019-10-01T14:43:15Z")
**Posts on this page:** 7
**Page:** 2
### Author:  [@andreas-ibm](https://discourse.nodered.org/u/andreas-ibm)
#### Post date: [2 October 2019 14:09 UTC](https://discourse.nodered.org/t/mqtt-ssl-tls-connection/16156/21 "2019-10-02T14:09:42Z")
Re-run the `openssl s_client` command to see if it's changed the ssl endpoint... I'd guess that the extra listener has shifted the SSL config a little
---
### Author:  [@ChrisO](https://discourse.nodered.org/u/ChrisO)
#### Post date: [2 October 2019 15:24 UTC](https://discourse.nodered.org/t/mqtt-ssl-tls-connection/16156/22 "2019-10-02T15:24:32Z")
I ran it twice, once for port 8883 and once for port 8884
running it for port 8883 gave me a write:errno=104
for port 8884 asked for verify return:1
[connection8883.txt](https://discourse.nodered.org/uploads/short-url/mgREI9mp2MIOTkZh7ll1aNwCnqX.txt) (2.3 KB) [connection8884.txt](https://discourse.nodered.org/uploads/short-url/11r3dSK76aICGnwyGEhpXO6hhpn.txt) (13.6 KB)
Chris
---
### Author:  [@andreas-ibm](https://discourse.nodered.org/u/andreas-ibm)
#### Post date: [2 October 2019 15:39 UTC](https://discourse.nodered.org/t/mqtt-ssl-tls-connection/16156/23 "2019-10-02T15:39:58Z")
I'd suggest you check the positioning of your `listener` lines compared to your `cafile`, `certfile`, and `keyfile` lines.. The `cafile` and friends apply to the _most recent_ `listener` lines.
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [2 October 2019 18:56 UTC](https://discourse.nodered.org/t/mqtt-ssl-tls-connection/16156/24 "2019-10-02T18:56:52Z")
> [@andreas-ibm](#):
>
> Thankfully windows has caught up with the rest of the sane world, so that redirect is simple. Add `> C:\node-red.log 2>&1`
Urm, you are showing your bias there - Even DOS did that! 😉
> [@ChrisO](#):
>
> Disabled Verify server certs
This will be the culprit. If you generated your own certificate, unless you were very thorough and generated a root cert as well and then made Mosquitto aware of the root then it had no way of verifying your cert.
---
### Author:  [@karthik](https://discourse.nodered.org/u/karthik)
#### Post date: [15 June 2021 02:20 UTC](https://discourse.nodered.org/t/mqtt-ssl-tls-connection/16156/25 "2021-06-15T02:20:01Z")
Hi i am have also tried the same thing both andreas-ibm and ChrisO tried but for me i am stuck at this part as i only get this as my output when I used this
openssl s\_client -connect localhost:8883 -CAfile C:\mosquitto\certs\ca.crt -prexit
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [15 June 2021 15:33 UTC](https://discourse.nodered.org/t/mqtt-ssl-tls-connection/16156/26 "2021-06-15T15:33:17Z")
There is a more comprehensive example of a full TLS configuration for MQTT elsewhere on the forum so you should do some more searching for that.
If using self-generated certs, make sure you turn off certificate checks unless you have done ALL of the steps required and provided the full-chain certificate and not just the server cert. since that is the only way that the client will have of checking that the certificate is valid.
---
### Author:  [@karthik](https://discourse.nodered.org/u/karthik)
#### Post date: [16 June 2021 03:57 UTC](https://discourse.nodered.org/t/mqtt-ssl-tls-connection/16156/27 "2021-06-16T03:57:07Z")
Thank you but I have successful made it work. It was regarding the pem issue addressed earlier
But now if i bring over my certificate for the SSL into my node-red it does not seem to work
I kinda new to this, so sorry.
[Previous page](https://discourse.nodered.org/t/mqtt-ssl-tls-connection/16156.md?page=1)