nico VS certstrap

Let's talk about HTTP proxies first. There are actually two types of HTTP proxies, one is a reverse proxy, such as nico and nginx, which are not shown here. The other is tunnel proxy. We mainly expand this kind of proxy. It can proxy any content based on TCP. Note that there is a misunderstanding here. Many people think that HTTP proxy can only proxy http:// content, but it can also proxy https: // and any TCP-based content, but can't proxy UDP content, and we'll see why it can't proxy UDP content later.

So setup a CA (I find certstrap simplifies this), load the CA cert into Mosquitto (cafile). Then you can issue any number of certificates that will allow clients to connect (you don't need to touch the broker config when adding new clients).

git clone https://github.com/square/certstrap cd certstrap git checkout v1.3.0 docker build -t squareup/certstrap . alias certstrap='docker run -i --rm -v $PWD:/out squareup/certstrap'

I like certstrap for this sort of thing, personally. I used to bugger about with OpenSSL but that’s far too real ale these days.

There are many ways to do this but my favorite is Certstrap.

Sounds like the issue is with your certificate itself, perhaps look at something which helps with local certificates management like https://github.com/square/certstrap

If you want to create your own CA, Certstrap by Square is really handy and simple to setup. I use this to generate valid certs for all my internal services (NAS, ESXI, etc).

Because OpenSSL is quite complex to use, we'll use certstrap for generation of certificates, install certstrap from here.