Unable to connect (A TLS error occurred.). - but no more info

[fredrik-jansson-se]

Mosquitto version: 2.0.18

mosquitto_sub -d --insecure -h 192.168.4.23 -p 8883 -t test -u test-user -P test-pwd
Unable to connect (A TLS error occurred.).

Mosquitto log:

1706611361: mosquitto version 2.0.18 starting
1706611361: Config loaded from /mosquitto/config/mosquitto.conf.
1706611361: Opening ipv4 listen socket on port 8883.
1706611361: mosquitto version 2.0.18 running
1706611370: New connection from 192.168.0.20:39974 on port 8883.
1706611370: Client <unknown> closed its connection.

I have tried both RSA (below) and ECDSA certs, but the same result.

I've tried to provide all relevant info below.

mosquitto.conf

listener 8883 0.0.0.0
log_type debug
log_type error
log_type warning
log_type notice
log_type information
password_file /mosquitto/config/password
cafile /mosquitto/cert/ca-cert.pem
certfile /mosquitto/cert/cert.pem
keyfile /mosquitto/cert/cert.key

cat /mosquitto/config/password

test-user:$7$101$ctWMAD+/YScCjE9m$mzaBRxx9APbjOcsFkwr0brASw1jIjDPsEiRdmvWmYOycQ3OC4f9C9zUBjhdTCkLl8afToTeTFSTXxtztLIiO5g==

/mosquitto/cert/ca-cert.pem
-----BEGIN CERTIFICATE-----
MIIDkTCCAnmgAwIBAgITALTHDMZZb2nBqNrJB6/AISKbRTANBgkqhkiG9w0BAQsF
ADBaMQ8wDQYDVQQDEwZBdmFzc2ExEjAQBgNVBAcTCVN0b2NraG9sbTELMAkGA1UE
BhMCU0UxDzANBgNVBAoTBkF2YXNzYTEVMBMGA1UECxMMZGlzdHJpYnV0aW9uMCIY
DzIwMjQwMTE5MTExNjIzWhgPMjAyNzAxMjkxMDA0MjNaMFoxDzANBgNVBAMTBkF2
YXNzYTESMBAGA1UEBxMJU3RvY2tob2xtMQswCQYDVQQGEwJTRTEPMA0GA1UEChMG
QXZhc3NhMRUwEwYDVQQLEwxkaXN0cmlidXRpb24wggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQClPwMmRlOEG6IOLDp5oCE/QYsDDQAOy1MCpv5HgDTkY7o9
372pxIgtInfe6gudqa18/Ux6xooOH95i4eoyyP0gkA2q+gj6IxHWjbcaPCx0lsMH
UkjYLeYFTr93dnUppklQW5igqk0YxwnwwX2pNOXDfQ6UiNhOHAZRtj83DFXLm6G0
8vlDCzkeSuqXfL3fN0Pg22WYLckiHqpZz7lzjAM+rJneiXuHmJibSEtdV8CcvWnw
WUTYWsfeT2kEr42nSS2/QG8BwlIsa95Ru6Ii6csJsvcMa74oVUUlejz7CoImI8fa
b/uMuE/kD4CfQPk2O+RWXkxMTH2cJpGDI3W4ZpgPAgMBAAGjTDBKMA4GA1UdDwEB
/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6
Ly9jcmwuYXZhc3NhLm5ldC8wDQYJKoZIhvcNAQELBQADggEBAFNCBpfbhgftHv9l
AKbLyigR3gqQgNBHz/AdbdjCFZcQd34VMNzzB5PNRPeFaWWf0ihE3BpqGURRafNi
gaheuRNtkbFbNxVcaO+to1ubfrXCcWfLDxLqGIqnU4LKcGU+apY9+SY4OgvJmJmt
rm27iga6uxWG5Mkutijr/OrVEc1OBF9OlwUdIZDMuc+wlGx4OwWfA34pWZHA6drW
tK4srEMPFNuGCt46dbC/CBfvcJzfnyNFXm7bP+g/vPQGd0ybLxMlPEcxsCvKPEio
NXnZqZtvaoobR8ZDGBcSnarWYKOAWO4IwaLVQoTFBgg2vHrvSzoyrac6Ql/T5NcL
fkLcfdw=
-----END CERTIFICATE-----


/mosquitto/cert/cert.key
-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAyxuXj3dGY+SvIlH63N1BFgkelATVRyGL5RIzPHLqh3Vynq8V
SxqPkSZWmsCXUOIWZQa3rBWa9jm7Nh51jMRXpdtnsj109RPnAxjtH/Ac5FoWLwlA
upgbmOipbnzm4JSJ8hNk0B7RdKE3Chdp3QF8Kmuqa/S0loPIXmY2L3VtF3EgRpdi
oXiGvbkNqse7LOYS8IjD5/AK8PXRm20/4+0HJEmpfSnDuoOyi+iT2Xf1Pb00uo6V
OsExTp4fmjlQuQabAn/XILaLSMnDngWCgcmtCOFTjRGSl5ouv6YNNv75Fzjxm7DM
eQE/B6US1zh/y7yn+lLxyfs8UsVnznSavtU4CwIDAQABAoIBAHXTbOoSdKhQqvTL
ADAOvspMwgt2fk/Ee0aJd2Wy+LFahgLeaQjnwK+gwQ8HeQC4F+vFqNnQstPyi9OK
egEOihYyoQZ6tpXSVOqsFCu5/NjQFhx1TrKwuRnMpzXsiXdxVFE1xP8jUblKKQbW
rFhEm0Z0rSnxjK3gh2WUAA0qHv5AXn485Pb62r7YXPlEiegqz7fMXIcS/8KBdV9j
Qfo8yTbjCm43IfWMYEYzivb6SyGl/cCIQJPBTRN9fHr7Bb84OR5i5pSXlB93x7ZE
lf3lyhADUEIPm/rUc0cHqtB6tCjSSB+fLGZbMxwvrDmuylrvuAHdrGauxUU2m5oq
rUY+xdECgYEA7eV17dSbCRIi+29qk/O+U4r6DZMnlpIV16o0UWdwtL7SKXGP5JnF
VSbgjl1aETIYG+T+YRYfzOx8GhmW6RuGt4MFaDSJVDW5zGkZD1rpjgObSCcmvvdc
AiGmAzs3tRwp//2SEkkDHLL1c1RS2IIWcPhJ7d/CmBDGdIMlPFzvTqMCgYEA2pBn
YBNRmtQG2D0r9sjc7RDWGuZBl0YG49EuJhn4QVKM/cVjJ3l5n7xWvBD1X+9iOWMW
YzypvGzIDkQtiJ1HDkxugHW/R5PxFbBYooMJu/xo6lWQBMwtB7bqFQn0oaPKIMlL
BtTABXmq8MgvN2f2f5xvms9JRFN6EQRrClDEj3kCgYAD97C4z7PqOdA1i00mvIjv
EcFL2qltXHBa0W7f8K6zhP8yS7+Pm3TsD6LtHOd0o/Y8+Nu5OMo8+7CyKr0WlCvy
AZBkhYPI0MCRhSsy01xTzwGW+Xgu9ScmrfL72M/8CEU3DL6T6X3Qy7dGPiDHlZvU
NH/fJL01FgqJROqpEA+5qwKBgB96ktj8j1FMXlwAm3dkwKUIOr4PEb1W4aEoPIxS
SzYlTJc0Oa6yyTifaKKXkq+pi60WP2A1mYDA7iNX4HL/q/88NOIdk1oczalBB9MI
Knu/w+CUSDTYr1egGaDEGU66h18nfr3SIIHpXxxkyKAjQhZpEo3qcvP7TeZri3sl
3NmJAoGAQE/bTqMDEQTQtuKBAIYVaVOwc9EZS6qt1VZAHP7lXtEaUb7qfnpQTEjU
Qe5UqJj/rwW+NtIHJJTmqAtK+P3Aso1CbvDbIjiENKetmYR8rPHtA6sniepr4v10
XCtAI2SWl3GwRaAXB1NTFDX/DrLx81ZD4+KNVxJjx0IDvQdZEwU=
-----END RSA PRIVATE KEY-----

/mosquitto/cert/cert.pem
-----BEGIN CERTIFICATE-----
MIIEbjCCA1igAwIBAgITAP5TMiTrZwUv1/wxpa7ypiEpRjALBgkqhkiG9w0BAQsw
WjEPMA0GA1UEAxMGQXZhc3NhMRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNVBAYT
AlNFMQ8wDQYDVQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvbjAiGA8y
MDI0MDEzMDAzMzA0MVoYDzIwMjQwMjI5MTA0MjQxWjBdMRIwEAYDVQQDEwltb3Nx
dWl0dG8xEjAQBgNVBAcTCVN0b2NraG9sbTELMAkGA1UEBhMCU0UxDzANBgNVBAoT
BkF2YXNzYTEVMBMGA1UECxMMZGlzdHJpYnV0aW9uMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAyxuXj3dGY+SvIlH63N1BFgkelATVRyGL5RIzPHLqh3Vy
nq8VSxqPkSZWmsCXUOIWZQa3rBWa9jm7Nh51jMRXpdtnsj109RPnAxjtH/Ac5FoW
LwlAupgbmOipbnzm4JSJ8hNk0B7RdKE3Chdp3QF8Kmuqa/S0loPIXmY2L3VtF3Eg
RpdioXiGvbkNqse7LOYS8IjD5/AK8PXRm20/4+0HJEmpfSnDuoOyi+iT2Xf1Pb00
uo6VOsExTp4fmjlQuQabAn/XILaLSMnDngWCgcmtCOFTjRGSl5ouv6YNNv75Fzjx
m7DMeQE/B6US1zh/y7yn+lLxyfs8UsVnznSavtU4CwIDAQABo4IBKDCCASQwfgYD
VR0jBHcwdaFepFwwWjEPMA0GA1UEAxMGQXZhc3NhMRIwEAYDVQQHEwlTdG9ja2hv
bG0xCzAJBgNVBAYTAlNFMQ8wDQYDVQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3Ry
aWJ1dGlvboITALTHDMZZb2nBqNrJB6/AISKbRTCBhgYDVR0RBH8wfYIJbW9zcXVp
dHRvghdtcXR0Lm1vc3F1aXR0by5pbnRlcm5hbIJLbXF0dC5tb3NxdWl0dG8udGhl
LWNvbXBhbnkuc3RvY2tob2xtLWNsdXN0ZXIuc2wtdGVzdC50aGUtY29tcGFueS5h
dmFzc2EubmV0hwSsHgABhwTAqAQXMAsGA1UdDwQEAwIDiDAMBgNVHRMBAf8EAjAA
MAsGCSqGSIb3DQEBCwOCAQEAFsF6PEjrHBbtuK691xC6Ymk0MArH11iChYRi4f2Q
UIMdkY2wB82YxHkGbixnlYHaVq/VjUEN/vwyufNUxbBnKT1u0eHyUNrYM0H03ayI
DFgIzWOs0YRqfOhjsNtFo8TahZK3hLIs3DIqk3/rgoi+5VXYckaNmPPfMzgGG/OE
DNIEUQHun1bwT3KjFm4PViI5of/FOlWZ15CY0J+J41kIzs/G7BJBnh2Qo66Rzux5
y+cVXk5Q/CCjDdHfCOcFXK1FbZ31TLqW/61uZXV8I0nMotzdVDK3h7AjGiYgiqMm
Kr8U/Nce8YEbePIso7GMqF2mKLJHEPCTE0Hv0lpf/5vEhw==
-----END CERTIFICATE-----

openssl s_client -connect 192.168.4.23:8883 -showcerts
CONNECTED(00000004)
Can't use SSL_get_servername
depth=1 CN = Avassa, L = Stockholm, C = SE, O = Avassa, OU = distribution
verify error:num=19:self-signed certificate in certificate chain
verify return:1
depth=1 CN = Avassa, L = Stockholm, C = SE, O = Avassa, OU = distribution
verify return:1
depth=0 CN = mosquitto, L = Stockholm, C = SE, O = Avassa, OU = distribution
verify return:1
---
Certificate chain
 0 s:CN = mosquitto, L = Stockholm, C = SE, O = Avassa, OU = distribution
   i:CN = Avassa, L = Stockholm, C = SE, O = Avassa, OU = distribution
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jan 30 03:30:41 2024 GMT; NotAfter: Feb 29 10:42:41 2024 GMT
-----BEGIN CERTIFICATE-----
MIIEbjCCA1igAwIBAgITAP5TMiTrZwUv1/wxpa7ypiEpRjALBgkqhkiG9w0BAQsw
WjEPMA0GA1UEAxMGQXZhc3NhMRIwEAYDVQQHEwlTdG9ja2hvbG0xCzAJBgNVBAYT
AlNFMQ8wDQYDVQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3RyaWJ1dGlvbjAiGA8y
MDI0MDEzMDAzMzA0MVoYDzIwMjQwMjI5MTA0MjQxWjBdMRIwEAYDVQQDEwltb3Nx
dWl0dG8xEjAQBgNVBAcTCVN0b2NraG9sbTELMAkGA1UEBhMCU0UxDzANBgNVBAoT
BkF2YXNzYTEVMBMGA1UECxMMZGlzdHJpYnV0aW9uMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAyxuXj3dGY+SvIlH63N1BFgkelATVRyGL5RIzPHLqh3Vy
nq8VSxqPkSZWmsCXUOIWZQa3rBWa9jm7Nh51jMRXpdtnsj109RPnAxjtH/Ac5FoW
LwlAupgbmOipbnzm4JSJ8hNk0B7RdKE3Chdp3QF8Kmuqa/S0loPIXmY2L3VtF3Eg
RpdioXiGvbkNqse7LOYS8IjD5/AK8PXRm20/4+0HJEmpfSnDuoOyi+iT2Xf1Pb00
uo6VOsExTp4fmjlQuQabAn/XILaLSMnDngWCgcmtCOFTjRGSl5ouv6YNNv75Fzjx
m7DMeQE/B6US1zh/y7yn+lLxyfs8UsVnznSavtU4CwIDAQABo4IBKDCCASQwfgYD
VR0jBHcwdaFepFwwWjEPMA0GA1UEAxMGQXZhc3NhMRIwEAYDVQQHEwlTdG9ja2hv
bG0xCzAJBgNVBAYTAlNFMQ8wDQYDVQQKEwZBdmFzc2ExFTATBgNVBAsTDGRpc3Ry
aWJ1dGlvboITALTHDMZZb2nBqNrJB6/AISKbRTCBhgYDVR0RBH8wfYIJbW9zcXVp
dHRvghdtcXR0Lm1vc3F1aXR0by5pbnRlcm5hbIJLbXF0dC5tb3NxdWl0dG8udGhl
LWNvbXBhbnkuc3RvY2tob2xtLWNsdXN0ZXIuc2wtdGVzdC50aGUtY29tcGFueS5h
dmFzc2EubmV0hwSsHgABhwTAqAQXMAsGA1UdDwQEAwIDiDAMBgNVHRMBAf8EAjAA
MAsGCSqGSIb3DQEBCwOCAQEAFsF6PEjrHBbtuK691xC6Ymk0MArH11iChYRi4f2Q
UIMdkY2wB82YxHkGbixnlYHaVq/VjUEN/vwyufNUxbBnKT1u0eHyUNrYM0H03ayI
DFgIzWOs0YRqfOhjsNtFo8TahZK3hLIs3DIqk3/rgoi+5VXYckaNmPPfMzgGG/OE
DNIEUQHun1bwT3KjFm4PViI5of/FOlWZ15CY0J+J41kIzs/G7BJBnh2Qo66Rzux5
y+cVXk5Q/CCjDdHfCOcFXK1FbZ31TLqW/61uZXV8I0nMotzdVDK3h7AjGiYgiqMm
Kr8U/Nce8YEbePIso7GMqF2mKLJHEPCTE0Hv0lpf/5vEhw==
-----END CERTIFICATE-----
 1 s:CN = Avassa, L = Stockholm, C = SE, O = Avassa, OU = distribution
   i:CN = Avassa, L = Stockholm, C = SE, O = Avassa, OU = distribution
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jan 19 11:16:23 2024 GMT; NotAfter: Jan 29 10:04:23 2027 GMT
-----BEGIN CERTIFICATE-----
MIIDkTCCAnmgAwIBAgITALTHDMZZb2nBqNrJB6/AISKbRTANBgkqhkiG9w0BAQsF
ADBaMQ8wDQYDVQQDEwZBdmFzc2ExEjAQBgNVBAcTCVN0b2NraG9sbTELMAkGA1UE
BhMCU0UxDzANBgNVBAoTBkF2YXNzYTEVMBMGA1UECxMMZGlzdHJpYnV0aW9uMCIY
DzIwMjQwMTE5MTExNjIzWhgPMjAyNzAxMjkxMDA0MjNaMFoxDzANBgNVBAMTBkF2
YXNzYTESMBAGA1UEBxMJU3RvY2tob2xtMQswCQYDVQQGEwJTRTEPMA0GA1UEChMG
QXZhc3NhMRUwEwYDVQQLEwxkaXN0cmlidXRpb24wggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQClPwMmRlOEG6IOLDp5oCE/QYsDDQAOy1MCpv5HgDTkY7o9
372pxIgtInfe6gudqa18/Ux6xooOH95i4eoyyP0gkA2q+gj6IxHWjbcaPCx0lsMH
UkjYLeYFTr93dnUppklQW5igqk0YxwnwwX2pNOXDfQ6UiNhOHAZRtj83DFXLm6G0
8vlDCzkeSuqXfL3fN0Pg22WYLckiHqpZz7lzjAM+rJneiXuHmJibSEtdV8CcvWnw
WUTYWsfeT2kEr42nSS2/QG8BwlIsa95Ru6Ii6csJsvcMa74oVUUlejz7CoImI8fa
b/uMuE/kD4CfQPk2O+RWXkxMTH2cJpGDI3W4ZpgPAgMBAAGjTDBKMA4GA1UdDwEB
/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MCcGA1UdHwQgMB4wHKAaoBiGFmh0dHA6
Ly9jcmwuYXZhc3NhLm5ldC8wDQYJKoZIhvcNAQELBQADggEBAFNCBpfbhgftHv9l
AKbLyigR3gqQgNBHz/AdbdjCFZcQd34VMNzzB5PNRPeFaWWf0ihE3BpqGURRafNi
gaheuRNtkbFbNxVcaO+to1ubfrXCcWfLDxLqGIqnU4LKcGU+apY9+SY4OgvJmJmt
rm27iga6uxWG5Mkutijr/OrVEc1OBF9OlwUdIZDMuc+wlGx4OwWfA34pWZHA6drW
tK4srEMPFNuGCt46dbC/CBfvcJzfnyNFXm7bP+g/vPQGd0ybLxMlPEcxsCvKPEio
NXnZqZtvaoobR8ZDGBcSnarWYKOAWO4IwaLVQoTFBgg2vHrvSzoyrac6Ql/T5NcL
fkLcfdw=
-----END CERTIFICATE-----
---
Server certificate
subject=CN = mosquitto, L = Stockholm, C = SE, O = Avassa, OU = distribution
issuer=CN = Avassa, L = Stockholm, C = SE, O = Avassa, OU = distribution
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 2616 bytes and written 373 bytes
Verification error: self-signed certificate in certificate chain
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 19 (self-signed certificate in certificate chain)
---