Connection to mosquitto failed with error code 'error:1408F10B:SSL routines:ssl3_get_record:wrong version number'

Question

I'm having problems configuring mosquitto with SSL. Everything works fine in clear text (1883) but when I do the SSL configuration and test it (8883), I get the following errors:

mosquitto_pub --host 127.0.0.1 --port 8883 --topic test -m "bankai" --key /etc/mosquitto/certs/server.key --cert /etc/mosquitto/certs/server.crt
Error: The connection was lost.
    
1659527333: Client connection from 127.0.0.1 failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number

mosquitto_pub --host my.server.org --port 8883 --topic test -m "bankai" --key /etc/mosquitto/certs/server.key --cert /etc/mosquitto/certs/server.crt
Error: The connection was lost.
    
1659527333: Client connection from 147.xxx.yyy.zzz failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number

mosquitto_pub --host 127.0.0.1 --port 8883 --topic test -m "bankai" --cafile /etc/mosquitto/ca_certificates/ca.crt
Error: A TLS error occurred.
    
1659527858: New connection from 127.0.0.1 on port 8883.

mosquitto_pub --host my.server.org --port 8883 --topic test -m "bankai" --cafile /etc/mosquitto/ca_certificates/ca.crt
Error: The connection was lost.
    
1659528143: OpenSSL Error: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
1659528143: Socket error on client <unknown>, disconnecting.
1659528184: New connection from 147.xxx.yyy.zzz on port 8883.

I really need your help because I don't know what to do now! Thanks in advance :)

---

On the SSL configuration side, in accordance with the documentation :

• i created a CA key pair

openssl genrsa -out ca.key 2048

• i created a CA certificate and use the ca.key to sign it

openssl req -new -x509 -days 3650 -extensions v3_ca -key ca.key -out ca.crt -subj "/C=FR/ST=Occitanie/L=Toulouse/O=MyCompany/OU=MyUnit/CN=my.server.org"

• i created a key pair for the MQTT server

openssl genrsa -out server.key 2048

• i created a CSR file using the server.key

openssl req -new -out server.csr -key server.key -subj "/C=FR/ST=Occitanie/L=Toulouse/O=MyCompany/OU=MyUnit/CN=my.server.org" -addext subjectAltName=IP:147.xxx.yyy.zzz,IP:192.168.xxx.yyy,IP:127.0.0.1,DNS:my.server.org,DNS:myhostname,DNS:localhost

• i used the ca.key to sign the server.csr and to create server.crt

openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 3650

• i copied the ca.crt, server.crt and server.key files to the appropriate mosquitto folders

cp /etc/ssl/mycerts/mosquitto/ca.crt /etc/mosquitto/ca_certificates/ca.crt
cp /etc/ssl/mycerts/mosquitto/server.crt /etc/mosquitto/certs/server.crt
cp /etc/ssl/mycerts/mosquitto/server.key /etc/mosquitto/certs/server.key

• i created and configured the /etc/mosquitto/conf.d/ssl.conf file as :

#
# configuration mosquitto SSL
#

# port
listener 8883

# ssl files
cafile   /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile  /etc/mosquitto/certs/server.key

# tls options
require_certificate true
tls_version tlsv1.2

• i restarted the mosquitto service

systemctl restart mosquitto.service
systemctl status mosquitto.service

        ● mosquitto.service - Mosquitto MQTT v3.1/v3.1.1 Broker
           Loaded: loaded (/lib/systemd/system/mosquitto.service; enabled; vendor preset: enabled)
           Active: active (running) since Tue 2022-07-26 14:12:48 CEST; 15s ago
             Docs: man:mosquitto.conf(5)
                   man:mosquitto(8)
         Main PID: 30769 (mosquitto)
            Tasks: 1 (limit: 2059)
           CGroup: /system.slice/mosquitto.service
                   └─30769 /usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf

        Jul 26 14:12:48 raspberrypi systemd[1]: Starting Mosquitto MQTT v3.1/v3.1.1 Broker...
        Jul 26 14:12:48 raspberrypi mosquitto[30769]: Loading config file /etc/mosquitto/conf.d/ssl.conf
        Jul 26 14:12:48 raspberrypi systemd[1]: Started Mosquitto MQTT v3.1/v3.1.1 Broker.

• i checked that port 8883 was listening

netstat -plunt | grep mosquitto

        tcp        0      0 0.0.0.0:8883            0.0.0.0:*               LISTEN      30769/mosquitto
        tcp        0      0 0.0.0.0:1883            0.0.0.0:*               LISTEN      30769/mosquitto
        tcp6       0      0 :::8883                 :::*                    LISTEN      30769/mosquitto
        tcp6       0      0 :::1883                 :::*                    LISTEN      30769/mosquitto

• i created a key pair for the client

openssl genrsa -des3 -out client.key 2048

• i created a CSR file using the client.key

openssl req -new -out client.csr -key client.key -subj "/C=FR/ST=Occitanie/L=Toulouse/O=MyCompany/OU=MyUnit/CN=147.xxx.yyy.zzz"

• i used the ca.key to sign the client.csr and to create client.crt

openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 3650