Unable to start bridge (but config 'ok')

[chelliwell]

I'm starting to explore a mosquitto [1.4.14] bridge for our embedded platform, connecting to AWS with TLS.
The certificates are good (I can connect fine using them with mosquitto_sub); I can also do a bridge connection on Ubuntu [1.4.15] using the same config and same certs.
The config is

log_dest stderr
log_type information
connection MyBridge
bridge_cafile /home/aws-iot-rootCA.crt
bridge_certfile /home/2751a7-certificate.pem.crt
bridge_keyfile /home/2751a7-private.pem.key
address a22ycnwh1dogb9.iot.eu-west-2.amazonaws.com:8883
topic Gw/Br/# in
topic Gw/Br/# out
notifications false
cleansession true

On my platform, however, the connection fails:

1528379856: mosquitto version 1.4.14 (build date 2018-05-29 09:31:30+0100) starting
1528379856: Config loaded from /etc/mosquitto/mosquitto.conf.
1528379856: Opening ipv4 listen socket on port 1883.
1528379856: Opening ipv6 listen socket on port 1883.
1528379856: Warning: Address family not supported by protocol
1528379856: Bridge local.wg2.Bridge doing local SUBSCRIBE on topic Gw/Br/#
1528379856: Connecting bridge Bridge (a22ycnwh1dogb9.iot.eu-west-2.amazonaws.com:8883)
1528379857: Error: Unable to load CA certificates, check bridge_cafile "/home/aws-iot-rootCA.crt".
Segmentation fault

The segfault makes me wonder if it's a build problem. Any 'obvious' possibilities for causes of this? Could be something in how my custom build is configured and/or made?
As I say: a mosquitto_pub - on my platform - is ok using the same credentials.
Thanks.

[chelliwell]

Ok, figured this out with an strace: the directory containing the credentials files need to have permissions 755 (executable for all). Even though I'm running mosquitto as root.
Odd that mosquitto_sub doesn't object without it.

[toast-uz]

Is this all your config? Is there the user directive in your config? Without the user directive, if you run mosquitto-broker as root, mosuqitto should show a waning message "Warning: Mosquitto should not be run as root/administrator." If there is the user directive, your report is normal because of dropping privilege of mosquitto-broker.

[ralight]

I'm glad you've got this sorted. The segfault you found is real and worth fixing, so I've done that. Thanks for finding it!