mosquitto mqtt broker tls problem. IP doesn not match certificate's altnames-CodePudding

I have provided the broker and the client with certificates. The broker is avaible at 172.27.224.1.

When I try to connect with the client, I get following error message:

Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames: IP: 172.27.224.1 is not in the cert's list:
    at new NodeError (node:internal/errors:371:5)
    at Object.checkServerIdentity (node:tls:297:12)
    at TLSSocket.onConnectSecure (node:_tls_wrap:1540:27)
    at TLSSocket.emit (node:events:390:28)
    at TLSSocket._finishInit (node:_tls_wrap:944:8)
    at TLSWrap.ssl.onhandshakedone (node:_tls_wrap:725:12) {
  reason: "IP: 172.27.224.1 is not in the cert's list: ",
  host: '172.27.224.1',
  cert: {
    subject: [Object: null prototype] {
      C: 'AU',
      ST: 'Some-State',
      O: '',
      OU: '',
      CN: '172.27.224.1'
    },
    issuer: [Object: null prototype] {
      C: 'DE',
      ST: 'Some-State',
      O: '',
      OU: '',
      CN: '172.27.224.1'
    },
    [...]

What's the error here? The ca.crt is a self signed cert with issued for 172.27.224.1 and issued from 172.27.224.1. The client.crt is issed from 172.27.224.1 and issued for "username".

should't this work?

Steps I used to generate the certificate:

openssl genrsa -des3 -out ca.key 2048
openssl req -new -x509 -days 1826 -key ca.key -out ca.crt
openssl genrsa -out client.key 2048
openssl req -new -out client.csr -key client.key
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 360

I use for the client node.js v16.13 and the mqtt library.

CodePudding user response：

Assuming you are using OpenSSL to create the CA cert then you can do it as follows:

openssl req -x509 -nodes -newkey rsa:2048 -days 3650 -sha256 \
  -keyout ca.key -out ca.crt -reqexts SAN -extensions SAN \
  -subj '/CN=Broker Cert' \
  -config <(cat /etc/pki/tls/openssl.cnf; printf "[SAN]\nsubjectAltName=IP:172.27.224.1")

This makes an assumption that you are using a openss.cnf file stored at /etc/pki/tls/openssl.cnf

But as a rule it's better to create a CA cert and then sign server certs with that as it makes changing things easier and you don't need to update all the clients when you want to change something. It also makes issuing client certificates a lot easier.

Please do still update the question with details of the programming language and client library you are using that is now enforcing the SAN rules.