I used the RaspPi AIO installer for Home Assistant and am now trying to get mosquitto running with TLS enabled to eventually use with OwnTracks. I would like my location information to be as secure as possible. I do have SSL set up for http, I’m not sure if this is affecting things.
I decided to generate self-signed certificates. I used the shell script at the bottom of the OwnTracks TLS page to generate certificates. Here is the direct link to the script.
I downloaded the shell script to /home/pi/Download/mosquitto_certs. Then un-commented and edited the HOSTLIST setting to include my Home Assistant URL. then ran the script with sudo bash ./generate-CA.sh. This generated ca.crt, ca.key, ca.srl, raspberrypi.crt, raspberrypi.csr, and raspberrypi.key.
Then I made a directory in /etc/mosquitto called certs.
sudo mkdir /etc/mosquitto/certs
Then I changed to that directory.
cd /etc/mosquitto/certs
And copied ca.crt, ca.key, raspberrypi.crt, and raspberrypi.key to the certs folder. Then gave permission to mosquitto to access those files.
sudo chown mosquitto:mosquitto *
Next, I edited the pre-made mosquitto.conf that must have been included with the AIO installer.
sudo nano /etc/mosquitto/mosquitto.conf
Here are the edits I made to that file:
Lines 134-138:
# Port to use for the default listener.
#port 1883
port 8883
#listener 8883
protocol websockets
Lines 189-196:
cafile /etc/mosquitto/certs/ca.crt
#capath
# Path to the PEM encoded server certificate.
certfile /etc/mosquitto/certs/raspberrypi.crt
# Path to the PEM encoded keyfile.
keyfile /etc/mosquitto/certs/raspberrypi.key
Line 203:
tls_version tlsv1
Line 212:
require_certificate true
Line 217:
use_identity_as_username true
Now, I need to generate client certificates for Home Assistant.
cd /home/pi/Downloads/mosquitto_certs
sudo bash ./generate-CA.sh client hass
Which generated hass.crt, hass.csr, and hass.key.
I created a new directory to store these certs for Home Assistant.
sudo mkdir /home/hass/.homeassistant/certs
cd /home/hass/.homeassistant/certs
Then I copied the three files generated for hass to this new directory and gave permission to hass to access them.
sudo chown hass:hass *
This is what I added to my Home Assistant configuration for Home Assistant.
mqtt:
broker: 127.0.0.1
port: 8883
client_id: home-assistant-1
username: !secret mqtt_user
password: !secret mqtt_password
client_key: /home/hass/.homeassistant/certs/hass.key
client_cert: /home/hass/.homeassistant/certs/hass.crt
And then for OwnTracks:
device_tracker:
platform: owntracks
max_gps_accuracy: 200
When I reboot the Raspberry Pi, Home Assistant shows this error:
16-09-13 22:43:49 homeassistant.components.device_tracker: Error setting up platform owntracks
Traceback (most recent call last):
File "/srv/hass/hass_venv/lib/python3.4/site-packages/homeassistant/components/device_tracker/__init__.py", line 146, in setup_platform
if not platform.setup_scanner(hass, p_config, tracker.see):
File "/srv/hass/hass_venv/lib/python3.4/site-packages/homeassistant/components/device_tracker/owntracks.py", line 235, in setup_scanner
mqtt.subscribe(hass, LOCATION_TOPIC, owntracks_location_update, 1)
File "/srv/hass/hass_venv/lib/python3.4/site-packages/homeassistant/components/mqtt/__init__.py", line 177, in subscribe
MQTT_CLIENT.subscribe(topic, qos)
File "/srv/hass/hass_venv/lib/python3.4/site-packages/homeassistant/components/mqtt/__init__.py", line 351, in subscribe
_raise_on_error(result)
File "/srv/hass/hass_venv/lib/python3.4/site-packages/homeassistant/components/mqtt/__init__.py", line 449, in _raise_on_error
raise HomeAssistantError('Error talking to MQTT: {}'.format(result))
homeassistant.exceptions.HomeAssistantError: Error talking to MQTT: 1
Not sure what is wrong. Any help would be appreciated, and I’ll definitely update some documentation if we can get this figured out!
