Re: [mosquitto-dev] chain certificates?

[Greg Troxel <gdt@xxxxxxxxxx>]

Greg Troxel <gdt@xxxxxxxxxx> writes:

> So, I wonder if mosquitto copes with a fullchain file, and if so then
> this is a doc issue, and if not, it seems like a missing necessary
> feature.

It seems that passing the fullchain file as the cert does what I expect,
in that the intermediate cert and the EE cert are sent, and openssl
validates as expected.  So this is a doc bug, and man page/example
should explain that certfile should contain the full certificate chain,
including any intermediate certificates, and that e.g. if using Let's
Encrypt then "fullchain.pem" is appropriate.