no shared cipher with TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)

[AndreKR]

I'm connecting to Mosquitto from an ESP32 using the BearSSL library. This is the Client Hello:

Mosquitto logs:

error:140260C1:SSL routines:ACCEPT_SR_CLNT_HELLO:no shared cipher.

In my config I set

tls_version tlsv1.2
ciphers ECDHE-RSA-AES128-GCM-SHA256

but it doesn't help.

Mosquitto version 2.0.18 (Docker eclipse-mosquitto:latest)

[AndreKR]

How to reproduce:

• Configure Mosquitto for TLS:

listener 8883
certfile /mosquitto/certificates/mosquitto.crt
keyfile /mosquitto/certificates/mosquitto.key
tls_version tlsv1.2
ciphers ECDHE-RSA-AES128-GCM-SHA256

• On any machine that has OpenSSL installed run: openssl s_client -cipher ECDHE-RSA-AES128-GCM-SHA256 -tls1_2 -connect mosquitto:8883

[AndreKR]

The error message was super misleading but I found the issue: The private key was an EC key instead of an RSA key.