{"action":"created","issue":{"url":"https://api.github.com/repos/ckrey/MQTT-Client-Framework/issues/225","repository_url":"https://api.github.com/repos/ckrey/MQTT-Client-Framework","labels_url":"https://api.github.com/repos/ckrey/MQTT-Client-Framework/issues/225/labels{/name}","comments_url":"https://api.github.com/repos/ckrey/MQTT-Client-Framework/issues/225/comments","events_url":"https://api.github.com/repos/ckrey/MQTT-Client-Framework/issues/225/events","html_url":"https://github.com/ckrey/MQTT-Client-Framework/issues/225","id":184148220,"number":225,"title":"SSL connection: error 9831: no certificate returned","user":{"login":"Reetalibrarian","id":3782746,"avatar_url":"https://avatars.githubusercontent.com/u/3782746?v=3","gravatar_id":"","url":"https://api.github.com/users/Reetalibrarian","html_url":"https://github.com/Reetalibrarian","followers_url":"https://api.github.com/users/Reetalibrarian/followers","following_url":"https://api.github.com/users/Reetalibrarian/following{/other_user}","gists_url":"https://api.github.com/users/Reetalibrarian/gists{/gist_id}","starred_url":"https://api.github.com/users/Reetalibrarian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Reetalibrarian/subscriptions","organizations_url":"https://api.github.com/users/Reetalibrarian/orgs","repos_url":"https://api.github.com/users/Reetalibrarian/repos","events_url":"https://api.github.com/users/Reetalibrarian/events{/privacy}","received_events_url":"https://api.github.com/users/Reetalibrarian/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ckrey/MQTT-Client-Framework/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":9,"created_at":"2016-10-20T06:49:01Z","updated_at":"2016-10-21T15:10:47Z","closed_at":null,"body":"We surely can connect to the server if server is open for anyone without checking cert/key.\r\nHowever, since we added SSL, I kept receiving handshake failed or no certificate returned\r\n\r\nWe require pinning Certificate to verify the server (not self-signed certificate) \r\nand use p12 client certificate to verify the client side from server\r\n\r\ncode:\r\n\r\n```objective-c\r\n    NSString *certificate = [[NSBundle mainBundle] pathForResource:@\"server_cert\" ofType:@\"cer\"];\r\n    MQTTSSLSecurityPolicy *securityPolicy = [MQTTSSLSecurityPolicy policyWithPinningMode:MQTTSSLPinningModeCertificate];\r\n    securityPolicy.pinnedCertificates = @[[NSData dataWithContentsOfFile:certificate]];\r\n    securityPolicy.allowInvalidCertificates = NO;\r\n    securityPolicy.validatesCertificateChain = NO;\r\n    self.mqttSession = [[MQTTSession alloc]\r\n                       initWithClientId:@\"clientID\"\r\n                       userName:nil\r\n                       password:nil\r\n                       keepAlive:60\r\n                       cleanSession:YES\r\n                       will:NO\r\n                       willTopic:nil\r\n                       willMsg:nil\r\n                       willQoS:2\r\n                       willRetainFlag:NO\r\n                       protocolLevel:4\r\n                       runLoop:[NSRunLoop currentRunLoop]\r\n                       forMode:NSRunLoopCommonModes\r\n                       securityPolicy:securityPolicy\r\n                       certificates:[MQTTCFSocketTransport clientCertsFromP12:[[NSBundle mainBundle] pathForResource:@\"client_cert\" ofType:@\"p12\"] passphrase:@\"1234\"]];\r\n    self.mqttSession.delegate = self;\r\n    [self.mqttSession connectToHost:SERVICE_HOST port:8883 usingSSL:YES connectHandler:^(NSError *error) {\r\n        if (error) {\r\n            NSLog(@\"Error Connect %@\", error.localizedDescription);\r\n        } else {\r\n            NSLog(@\"Connected sessionPresent\");\r\n        }\r\n    }];\r\n ```\r\n\r\nServer log :\r\n##### OpenSSL Error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned\r\n\r\nMy Plist:\r\n\r\n ```\r\n<key>NSAppTransportSecurity</key>\r\n    <dict>\r\n        <key>NSExceptionDomains</key>\r\n        <dict>\r\n            <key>server_address</key>\r\n            <dict>\r\n                <key>NSIncludesSubdomains</key>\r\n                <true/>\r\n                <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>\r\n                <true/>\r\n                <key>NSTemporaryExceptionMinimumTLSVersion</key>\r\n                <string>TLSv1.2</string>\r\n                <key>NSTemporaryExceptionRequiresForwardSecrecy</key>\r\n                <false/>\r\n            </dict>\r\n        </dict>\r\n    </dict>\r\n ```\r\nServer SSL version: TLS V1.2\r\n\r\nDoes anyone know what's going on here? \r\n\r\nupdate: \r\nopenssl works fine with the following command\r\n```\r\nopenssl s_client -connect server_address:8883 -cert <client_cert> -key <client_key> -keyform PEM -CAfile <root_ca_cert>\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/ckrey/MQTT-Client-Framework/issues/comments/255403497","html_url":"https://github.com/ckrey/MQTT-Client-Framework/issues/225#issuecomment-255403497","issue_url":"https://api.github.com/repos/ckrey/MQTT-Client-Framework/issues/225","id":255403497,"user":{"login":"Reetalibrarian","id":3782746,"avatar_url":"https://avatars.githubusercontent.com/u/3782746?v=3","gravatar_id":"","url":"https://api.github.com/users/Reetalibrarian","html_url":"https://github.com/Reetalibrarian","followers_url":"https://api.github.com/users/Reetalibrarian/followers","following_url":"https://api.github.com/users/Reetalibrarian/following{/other_user}","gists_url":"https://api.github.com/users/Reetalibrarian/gists{/gist_id}","starred_url":"https://api.github.com/users/Reetalibrarian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Reetalibrarian/subscriptions","organizations_url":"https://api.github.com/users/Reetalibrarian/orgs","repos_url":"https://api.github.com/users/Reetalibrarian/repos","events_url":"https://api.github.com/users/Reetalibrarian/events{/privacy}","received_events_url":"https://api.github.com/users/Reetalibrarian/received_events","type":"User","site_admin":false},"created_at":"2016-10-21T15:10:47Z","updated_at":"2016-10-21T15:10:47Z","body":"Yes, they are the same. \r\n\r\nWe use cafile (rootCA.pem as you called) to generate all crt / key \r\nand this cafile also used as verify the server from app side. \r\n"}}
{"actor":{"display_login":"Reetalibrarian"}}