SSL config does not work with wildcard certificate

[smartathome]

I have a MQTT broker setup to work on 1883 and 8883 with a wildcard certificate. But from within the UI, when ever I change the port from 1883 to 8883, my MQTT stops working.

I did some testing within the docker container and installed the MQTT clients. I managed to publish a message successfully but have to specify the cafile option, just having the capath does not work. I also did have to copy paste the root certificate (GlobalSign) into the ca-certificates.crt file, as just copying the original .crt root certificate into the directory and specifying the capath does not work.

/etc/ssl/certs # mosquitto_pub -d -h apollo.hostname.com -u "ha" -p 8883 -P "password" -t "zwave" -m "test" --capath /etc/ssl/certs/
Client mosq-xB2rIOibGDfpxz23Dy sending CONNECT
OpenSSL Error[0]: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Error: A TLS error occurred.
/etc/ssl/certs # mosquitto_pub -d -h apollo.hostname.com -u "ha" -p 8883 -P "password" -t "zwave" -m "test" --cafile /etc/ssl/certs/GlobalSign_Root_CA.crt 
Client mosq-OnSk24blOKrhPJWoD5 sending CONNECT
Client mosq-OnSk24blOKrhPJWoD5 received CONNACK (0)
Client mosq-OnSk24blOKrhPJWoD5 sending PUBLISH (d0, q0, r0, m1, 'zwave', ... (4 bytes))
Client mosq-OnSk24blOKrhPJWoD5 sending DISCONNECT
/etc/ssl/certs # mosquitto_pub -d -h apollo.hostname.com -u "ha" -p 8883 -P "password" -t "zwave" -m "test" --cafile /etc/ssl/certs/ca-certificates.crt  
Client mosq-fWDayrPCGaya9AMzK8 sending CONNECT
Client mosq-fWDayrPCGaya9AMzK8 received CONNACK (0)
Client mosq-fWDayrPCGaya9AMzK8 sending PUBLISH (d0, q0, r0, m1, 'zwave', ... (4 bytes))
Client mosq-fWDayrPCGaya9AMzK8 sending DISCONNECT

Is there a way I need to specify the cafile option in the UI? The logs show the following whenever I switch on SSL:

pi@raspi1:~ $ docker logs e603b1dd44a5  | tail 
2021-08-06 09:53:12.318 INFO MQTT: MQTT client reconnecting
2021-08-06 09:53:12.326 INFO MQTT: MQTT client closed
2021-08-06 09:53:15.326 INFO MQTT: MQTT client reconnecting
2021-08-06 09:53:15.339 INFO MQTT: MQTT client closed
2021-08-06 09:53:18.339 INFO MQTT: MQTT client reconnecting
2021-08-06 09:53:18.350 INFO MQTT: MQTT client closed

[robertsLando]

If the broker url starts with 'mqtts://' the ca and cert key fields will show up

[smartathome]

Thanks! Nicely hidden away. :-)