The Agent could not perform re-connection when connecting to a MQTT broker through TLS

[antonioboian]

Hello everyone
I would like to report the behaviour of the agent when it tries to reconnect to an MQTT broker with TLS after that the first connection fails.
The error generated is the following DEVICE_SECURITY_LoadTrustStore: X509_STORE_add_cert() failed
So in a nutshell, if the broker is up when the Agent startup the Agent will be able to perform the connection with it, if instead, the broker is not up at the Agent startup the Agent will not be able to perform the reconnection process since the DEVICE_SECURITY_LoadTrustStore function fails.
The problem is related to the fact that when performing the reconnection it is passed to the function the same SSL_CTX object, which already contains the Trust store certificates loaded earlier and therefore the function X509_STORE_add_cert() fails. For instance by commenting the first return in DEVICE_SECURITY_LoadTrustStore function everything works

[holme-r]

I agree. The MQTT Connect callback should not be adding the trust store certs each time it is called, they only need to be added once. We will address this issue.
That said, I do not see DEVICE_SECURITY_LoadTrustStore() return a failure, so I wonder if it only occurs with certain releases of OpenSSL. I do not see the issue with OpenSSL 1.1.1c or 1.0.2g. Which version of OpenSSL do you see the issue with ?

[antonioboian]

Hi Holme-r thanks again for your answer, the version of OpenSSL I'm currently using is the 1.0.2q

[holme-r]

Thanks, also which version of libmosquitto do you see the issue with ?

[holme-r]

Closing, as fixed in release 5.0.0.