title: paho-mqtt connecting to broker with self-sign
body: <p>I am trying to connect python client (<code>paho-mqtt 1.5.0</code>) to mosquitto broker (self-signed certificate). Connecting using MQTT.fx with TLS certs works.
  But when I tried to connect using python client with this code (<a href="https://pastebin.com/raw/5EUPX70c" rel="nofollow noreferrer">full code</a>)</p>
  
  <pre><code>mqtt_client.username_pw_set(mqtt_username, password=mqtt_password)
  mqtt_client.on_connect = on_connect
  mqtt_client.on_publish = on_publish
  mqtt_client.tls_set(ca_certs=TLS_CA_CERT, certfile=TLS_CLIENT_CERT,
                      keyfile=TLS_CLIENT_KEY, cert_reqs=ssl.CERT_REQUIRED,
                      tls_version=ssl.PROTOCOL_TLSv1_2, ciphers=None)
  mqtt_client.tls_insecure_set(False)
  mqtt_client.connect(broker_endpoint, port=port)
  mqtt_client.loop_start()
  </code></pre>
  
  <p>I got following error </p>
  
  <pre><code>Traceback (most recent call last):
    File "device.py", line 99, in &lt;module&gt;
      main()
    File "device.py", line 88, in main
      if not connect(mqtt_client, MQTT_USERNAME,
    File "device.py", line 55, in connect
      mqtt_client.connect(broker_endpoint, port=port)
    File "/usr/local/lib/python3.8/site-packages/paho/mqtt/client.py", line 937, in connect
      return self.reconnect()
    File "/usr/local/lib/python3.8/site-packages/paho/mqtt/client.py", line 1100, in reconnect
      sock.do_handshake()
    File "/usr/local/lib/python3.8/ssl.py", line 1309, in do_handshake
      self._sslobj.do_handshake()
  ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1108)
  </code></pre>
  
  <p>Logs from broker </p>
  
  <pre><code>1586374114: New connection from 20.4.32.278 on port 8883.
  1586374114: OpenSSL Error[0]: error:14035418:SSL routines:ACCEPT_SR_CERT:tlsv1 alert unknown ca
  1586374114: OpenSSL Error[1]: error:140350E5:SSL routines:ACCEPT_SR_CERT:ssl handshake failure
  1586374114: Socket error on client &lt;unknown&gt;, disconnecting.
  </code></pre>
  
  <p>As per <a href="https://github.com/eclipse/paho.mqtt.python/issues/123" rel="nofollow noreferrer">this</a> issue I changed my code</p>
  
  <pre><code>mqtt_client.tls_set(ca_certs=TLS_CA_CERT, certfile=TLS_CLIENT_CERT,
                      keyfile=TLS_CLIENT_KEY, cert_reqs=ssl.CERT_NONE,
                      tls_version=ssl.PROTOCOL_TLSv1_2, ciphers=None)
  mqtt_client.tls_insecure_set(True) 
  </code></pre>
  
  <p>With this one I am able connect to broker. But first attempt of the script fails with </p>
  
  <pre><code>Traceback (most recent call last):
    File "device.py", line 99, in &lt;module&gt;
      main()
    File "device.py", line 88, in main
      if not connect(mqtt_client, MQTT_USERNAME,
    File "device.py", line 55, in connect
      mqtt_client.connect(broker_endpoint, port=port)
    File "/usr/local/lib/python3.8/site-packages/paho/mqtt/client.py", line 937, in connect
      return self.reconnect()
    File "/usr/local/lib/python3.8/site-packages/paho/mqtt/client.py", line 1100, in reconnect
      sock.do_handshake()
    File "/usr/local/lib/python3.8/ssl.py", line 1309, in do_handshake
      self._sslobj.do_handshake()
  OSError: [Errno 0] Error
  </code></pre>
  
  <p>I see this error on brocker side </p>
  
  <pre><code>1586379530: New connection from 20.4.32.278 on port 1883.
  1586379530: Client &lt;unknown&gt; disconnected due to protocol error.
  </code></pre>
  
  <p>Second attempt of the script with no changes works &amp; client connects on port</p>
  
  <pre><code>1586379710: New connection from 20.4.32.278 on port 8883.
  1586379710: New client connected from 20.4.32.278 as auto-697CC441-83F5-7F50-6DF8-E85F96DEA1D7 (p2, c1, k60, u'.device.dev.lightcloud.com').
  </code></pre>
  
  <p>Trying to understand why client on connect on port <code>1883</code> first time and fails then conect on port <code>8883</code> second time and succeeds.</p>
  
  <p>with <code>cert_reqs=ssl.CERT_NONE</code> &amp; <code>tls_insecure_set(True)</code> client will have complete insure connection with broker ? Is it safe to use it in non-production environment ?</p>