Connect async via TLS is different on Windows and Linux. about mqttnet HOT 3 OPEN

Hi @Basko-Dev

Thanks for describing your issue.

To help with this we need to understand how the endpoint is configured:

1. Does the endpoint use a trusted CA certificate? (this might be a different by OS, since Linux and Windows have different trust stores)
2. Which version of .NET are you using?
3. Can you run openssl s_client -connect 10.76.75.106:8883 and paste the results here? If you are using a custom CA, run the command with the parameter --CAfile

Flow and errors should be the same on Windows and Linux.

I understand the expectation, but MQTTnet is not implementing the TLS stack, it's based on .NET having different implementations per platform, and each platform might handle CA certificates differently.

I guess the callback is not triggered in Windows because the TLS stack fails before starting the certificate validation.

from mqttnet.

Hi @rido-min,

ad1. my MQTT broker uses self-signed CA certificate.
ad2. .NETCore 6.0.27
ad3. See the attached logs:
openssl s_client -connect broker_ip:8883 --CAfile cacert-v3.crt: s_client_with_cafile.txt
openssl s_client -connect broker_ip:8883: s_client_without_cafile.txt

from mqttnet.

.NET 7 introduced a new API to validate the chain with a CAfile, since you are in .NET6 you might need to implement the validation by yourself. Here is an example (note it's not in main, and I'm pointing to a specific commit)

https://github.com/Azure-Samples/MqttApplicationSamples/blob/4e785ae65e331d95cefd38a7b8d4f944a83fe209/mqttclients/dotnet/MQTTnet.Client.Extensions/WithTlsSettings.cs#L18

https://github.com/Azure-Samples/MqttApplicationSamples/blob/4e785ae65e331d95cefd38a7b8d4f944a83fe209/mqttclients/dotnet/MQTTnet.Client.Extensions/X509ChainValidator.cs

from mqttnet.