MQTTS: mosquitto broker doesn't use all cipher suites from OpenSSL

[demvy]

In continuation of DHE support issue, found new one. Seems, mosquitto doesn't use OpenSSL fully.
It can't launch broker with some cipher suites that are available in installed version of OpenSSL. During lauch, I see errors:

$ mosquitto -c mqtt_hce.conf -v
1606993071: mosquitto version 1.4.8 (build date Tue, 18 Jun 2019 11:59:34 -0300) starting
1606993071: Config loaded from mqtt_hce.conf.
1606993071: Opening ipv4 listen socket on port 1885.
1606993071: Opening ipv6 listen socket on port 1885.
1606993071: Error: Unable to set TLS ciphers. Check cipher list "DHE-RSA-CHACHA20-POLY1305".

In this time, I can up OpenSSL server (TCP socket with security) with cmd:
openssl s_server -cert device.crt -key device.key -accept 1885 -cipher DHE-RSA-CHACHA20-POLY1305 -verify 1 -CAfile rootCA_chain.pem -tls1_2

To launch mosquitto broker I've used this config:

cat mqtt_hce.conf
listener 1885
cafile ./rootCA_chain.pem
certfile ./device.crt
keyfile ./device.key
ciphers DHE-RSA-CHACHA20-POLY1305
require_certificate true
connection_messages true

Setup: Ubuntu 16.04 with official deb packages:
mosquitto version 1.4.8 (build date Tue, 18 Jun 2019)
OpenSSL 1.1.1a 20 Nov 2018

[ralight]

I've been looking into this and see the same as you, but so far I can't see what the difference is between what mosquitto uses and what s_server does. I'll keep looking.

[sectokia]

I think mosquitto is missing use of SSL_CTX_set_dh_auto, the default is off, so no DH is supported.

Some where in net__init_ssl_ctx add SSL_CTX_set_dh_auto(mosq->ssl_ctx,1); ?

[ralight]

Thanks @sectokia , that does indeed seem to fix it.

[demvy]

thanks @ralight @sectokia for fast fix!