MQTT: Is MQTT over websocket supported?

[Commifreak]

Hi.

I maybe have a future case, where a ESP32 should be connected to a MQTT-broker via Internet. This should be TLS secured and managed by a reverse Proxy (Traefik). Is MQTT over websocket supported inside the MQTT lib you use or have I to use the plain MQTT protocol for this case?

Thanks in advance!

[Commifreak]

I just tested it and it seems that wss:// is not supported, because the CA field does only pop up when entering mqtts://.

Thats totally fine.

But I encounter another - issue? thing?

It seems, that I always have to set a CA cert value? Why? I often use LetsEncrypt for TLS things and it would be great if the controller could include some sort of a trustes cacert inside its firmware? Or is missing space the issue here?

An option to disable Certificate check would also a nice feature.

[Commifreak]

And: Does the MQTT client you use support SNI when it comes to mqtts:// ?

[john30]

you can just use mqtts:// for enabling TLS. the CA is optional but without it your server cert needs to be an officially signed one. the regular CA certs are included in the firmware and used as long as no CA cert is entered in the UI.
websocket transport is currently not supported and I don't see a real benefit compared to mqtts, so wouldn't add it for the time being.
SNI I don't know, you can check yourself in the mqtt client

[Commifreak]

Interesting

I already have it running now with self signed cert directly with open 8883 Port. I tried it earlier with this (doesnt worked):

I tried to use my Traefik to handle mqtts via Port 443 and signed it with LE.

I got error codes on eas side as well as on mosquitto side (mosquitto said something like „first packet is not „connect“).

Have to try it again and post logs.

I dont found much for SNI in the docs. All I found is https://docs.espressif.com/projects/esp-at/en/latest/esp32/AT_Command_Set/MQTT_AT_Commands.html#cmd-mqttsni and Iam not sure if this even applies.

I try to search further.

EDIT: noteworthy: MQTT-Explorer worked well with Traefik 443 setup. I think its the SNI not working/missing inside esp-mqtt lib. The repo search for „sni“ got zero results.

Thanks so far!

[Commifreak]

Could this be an option?

https://github.com/espressif/esp-idf/blob/310e3caf31cc3d65cec48f0017e5babad02ad86e/docs/en/api-reference/protocols/esp_tls.rst#sni-server-name-indication

I dont know what you can adjust during MQTT init? It says SNI is only on by default using tls with HTTPS.

[Commifreak]

The AI shows

esp_mqtt_client_config_t
  → broker.verification.common_name

To be the right switch for that. Not sure.