# Node-Red and Mosquitto MQTT Encryption Clarification

**URL:** <https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472>\
**Category:** General\
**Created:** [29 May 2018 12:54 UTC](https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472 "2018-05-29T12:54:56Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![RyanStJohn](https://avatars.discourse-cdn.com/v4/letter/r/f9ae1b/32.png) [@RyanStJohn](https://discourse.nodered.org/u/RyanStJohn)\
**Post date:** [29 May 2018 12:54 UTC](https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472/1 "2018-05-29T12:54:56Z")

</div>

I am running a Mosquitto MQTT that is using TLSV1. I have generated the following files:

1. ca.crt
2. ca.key
3. ca.srl
4. server.crt
5. server.csr
6. server.key

I am able to use just "ca.crt" with MQTT.FX in order to publish and subscribe to a topic with TSLv1 encryption. My issue arises when I try to get Node-Red to communicate with my Mosquitto Broker. The nodes get stuck at "Connecting..."

**How can I get Node-Red to communicate securely with my Mosquitto Broker using the files listed above?**

Current set up (I have tried a bunch of combinations, though):  
 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/edf0b3e1c916c224c03412a5f6823395c035d12c.png)

Thank you,  
Ryan

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [29 May 2018 12:56 UTC](https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472/2 "2018-05-29T12:56:51Z")

</div>

Have you tried without verification of the cert first?

---

<div class="post-metadata">

**Author:** ![RyanStJohn](https://avatars.discourse-cdn.com/v4/letter/r/f9ae1b/32.png) [@RyanStJohn](https://discourse.nodered.org/u/RyanStJohn)\
**Post date:** [29 May 2018 12:59 UTC](https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472/3 "2018-05-29T12:59:28Z")

</div>

Yes, the nodes connect when I have “Verify Server Certificate” unchecked.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [29 May 2018 13:03 UTC](https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472/4 "2018-05-29T13:03:32Z")

</div>

OK, so that indicates one of:

- The CA cert is incorrectly formed or the actual cert is incorrectly formed in regard to the CA cert.
- Node-RED isn’t picking up the CA cert properly.

Do you get any errors in the Node-RED log?

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [29 May 2018 13:25 UTC](https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472/5 "2018-05-29T13:25:17Z")

</div>

Do you need to convert them to pem format ? (Sometimes crt == pem - but not always)  
eg [https://stackoverflow.com/questions/4691699/how-to-convert-crt-to-pem](https://stackoverflow.com/questions/4691699/how-to-convert-crt-to-pem)

---

<div class="post-metadata">

**Author:** ![RyanStJohn](https://avatars.discourse-cdn.com/v4/letter/r/f9ae1b/32.png) [@RyanStJohn](https://discourse.nodered.org/u/RyanStJohn)\
**Post date:** [29 May 2018 13:25 UTC](https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472/6 "2018-05-29T13:25:58Z")

</div>

So what I figured out playing around is that I am able to get it to work with the "Verify Server Certificate" checked if I do not put the private server key but instead just some random text. If I put the actual server key in the "private key" location then then the nodes will not connect.

Example of it working below with no server key but instead random text:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/5aa52d95ddc570eeaca0a97b744c9f4d25b7da5e.png)

Thoughts?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [29 May 2018 13:32 UTC](https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472/7 "2018-05-29T13:32:30Z")

</div>

Hmm, not really. Other than converting to PEM as Dave suggests.

Otherwise, maybe try creating the CA and server certs afresh. I have some instructions on GitHub if you need to do that, might be of help though they are a little dated.

> **[TotallyInformation/SelfSigned-Cert-Creator](https://github.com/TotallyInformation/SelfSigned-Cert-Creator)**
>
> A short script to make it easy to create a viable, trusted self-signed certificate that can be used for SSL/TLS in particular. - TotallyInformation/SelfSigned-Cert-Creator

---

<div class="post-metadata">

**Author:** ![RyanStJohn](https://avatars.discourse-cdn.com/v4/letter/r/f9ae1b/32.png) [@RyanStJohn](https://discourse.nodered.org/u/RyanStJohn)\
**Post date:** [29 May 2018 13:39 UTC](https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472/8 "2018-05-29T13:39:21Z")

</div>

Thanks for the quick responses! I will try your creator and also use the link dceejay suggested to put them into pem format as well and update this thread when I reach a solution that works for me.

---

<div class="post-metadata">

**Author:** ![pierslawson](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/pierslawson/32/15745_2.png) [@pierslawson](https://discourse.nodered.org/u/pierslawson)\
**Post date:** [3 January 2020 14:05 UTC](https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472/9 "2020-01-03T14:05:59Z")

</div>

Did you ever get this sorted?

I tried converting to a PEM but that made no difference. The MQTT nodes just sit with a "connecting" status and nothing shows up in debug. I have left both "Certificate" and "Private Key" completely blank as I'm not trying to use a client certificate. "CA Certificate" points to a local crt or pem file. If I put a non-existant file in "CA Certificate" I get an error in the debug window, so it appears it is looking at the right file.

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [3 January 2020 14:46 UTC](https://discourse.nodered.org/t/node-red-and-mosquitto-mqtt-encryption-clarification/472/10 "2020-01-03T14:46:41Z")

</div>

I don't know what MQTT port you are using, but have you opened that port in your broker's router, so that the client can connect?  
It's not necessary to do the same for the client.

Also check the file ownership of your client CA certificate, if it's root:root, then node-RED may not be able to read it. Try pi:root.