Hi!

There might be several issues, but I can try suggesting some stuff.

   public bool ValidateCertificates(MqttClientCertificateValidationEventArgs args)
   {
       var chain = new X509Chain();

       chain.ChainPolicy = new X509ChainPolicy
       {
           DisableCertificateDownloads = true,
           RevocationFlag = X509RevocationFlag.EndCertificateOnly,
           RevocationMode = X509RevocationMode.NoCheck,
           TrustMode = X509ChainTrustMode.CustomRootTrust,
           UrlRetrievalTimeout = new TimeSpan(0, 0, 0),
           VerificationFlags = X509VerificationFlags.NoFlag,
           VerificationTime = DateTime.Now,
           VerificationTimeIgnored = false,
           CustomTrustStore = { _signingCertificates.ToList()[0] }
       };

       chain.ChainPolicy.ExtraStore.AddRange(_signingCertificates);
       return chain.Build(new X509Certificate2(_clientCertificate));
   }

This is a custom callback that validates my tls1.3 certs, the custom trust store has the ca_cert as an X509Xertificate2 and the client certificate is the .pfx generated.

This could in turn be used with the MqttClientOptionsBuilder

.WithTlsOptions(opts =>
               {
                   opts.WithClientCertificates(_provider.GetCertificates());
                   opts.WithSslProtocols(SslProtocols.Tls13);
                   opts.UseTls();
                   opts.WithCertificateValidationHandler(_provider.ValidateCertificates);
                   opts.Build();
               })

The GetCertificates is pretty much

return new[] { _clientCertificate };

Which is the .pfx file.

Another thing that might of interest to check out is the way your operating system handles certificates, I use linux and I pretty much deploy the ca_cert to the certificate store

sudo update-ca-certificates --fresh
sudo cp ca/certificate.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

I assume that you are using windows so I am not familiar with how windows handles that so you might have to dig a little bit.

from mqttnet.

Hi @glwalsh

Can you provide the error messages?

I'd suggest the next steps:

1. Validate server TLS certificate

you only need to load the CAfile and use tlsOptions.WithTrustChain(), note that if your CA does not provide revocation endpoints, you might also need to use tlsOptions.WithRevocationMode(X509RevocationMode.NoCheck)

2. Configure the client certificate for authentication

first, you dont need to convert your pem/key files to pfx, as you can load the cert with X509Certificate2.CreateFromPemFile(certFile, keyFile), however there is this issue in .NET that requires to export/import the cert before using with new X509Certificate2(cert.Export(X509ContentType.Pkcs12)

second, you can load the client certificates in tlsOptions with

List<X509Certificate2> certs = new();
var cert = X509Certificate2.CreateFromPemFile(certFile, keyFile);
certs.Add(new X509Certificate2(cert.Export(X509ContentType.Pkcs12));
tlsOptions.WithClientCertificates(certs)

There is sample targeting mosquitto in https://github.com/Azure-Samples/MqttApplicationSamples/tree/main/scenarios/getting_started

from mqttnet.