Skip to content

Allow use of TLS without custom/self-signed certificate chain #349

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nanomad merged 4 commits into from
Jun 18, 2025
Merged

Allow use of TLS without custom/self-signed certificate chain #349

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
47feb82
allow use of tls without custom/self-signed certificate chain
bj00rn Jun 17, 2025
11371c4
use create_default_context() to create context with sane defaults
bj00rn Jun 18, 2025
77d74b4
chore: fix linting
bj00rn Jun 18, 2025
0bf6a95
fix mypy complaining
bj00rn Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions src/configuration/parser.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,9 +97,6 @@ def __parse_mqtt_transport(args: Namespace, config: Configuration) -> None:
config.mqtt_transport_protocol = TransportProtocol.TLS
if args.tls_server_cert_path:
config.tls_server_cert_path = args.tls_server_cert_path
else:
msg = f"No server certificate authority file provided for TLS MQTT URI {args.mqtt_uri}"
raise SystemExit(msg)
else:
msg = f"Invalid MQTT URI scheme: {parse_result.scheme}, use tcp or ws"
raise SystemExit(msg)
Expand Down
14 changes: 8 additions & 6 deletions src/publisher/mqtt_publisher.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,14 +50,16 @@ async def connect(self) -> None:
)
else:
self.client.set_auth_credentials(username=self.configuration.mqtt_user)

if self.transport_protocol.with_tls:
ssl_context = ssl.create_default_context()
cert_uri = self.configuration.tls_server_cert_path
LOG.debug(
f"Configuring network encryption and authentication options for MQTT using {cert_uri}"
)
ssl_context = ssl.SSLContext()
ssl_context.load_verify_locations(cafile=cert_uri)
ssl_context.check_hostname = False
if cert_uri:
LOG.debug(
f"Using custom CA file {cert_uri}"
)
ssl_context.load_verify_locations(cafile=cert_uri)
ssl_context.check_hostname = False
else:
ssl_context = None
await self.client.connect(
Expand Down