B4J Question Mqtt mosquito ssl config

What is the use case for this?

For production you should use a valid certificate if you want to secure the connection. Otherwise it will not protect against man in the middle attacks.

Note that you can purchase a certificate for as low as $20 per year.

It's just to ensure that the data sent from clients to broker is encrypted using ssl mechanism.
I would also allow to offer a sollution (mqtt with data encryption) based on b4x to others without the need to purchase a certicate and domain at the start.

I totally agree that for the production, a valid certivicete shoud be used.
I just asked if this feature can be added to mqtt client as an option.

Erel said:

Note that you can purchase a certificate for as low as $20 per year.

Click to expand...

Really? Where?

There are two different ways to work with self signed certificates:
1. You can manually add the self signed certificate to the computer trust store. This is done for example in B4i to support the builders.
This is secure and doesn't require any code change.

2. Configure the client to ignore the certificate (similar to Http.InitializeAcceptAll). This solution doesn't offer real security.
If you like to add this option to MqttClient then start a new thread for this in the wishlist forum.

You can instead use B4XCipher to encrypt some or all of the messages.

DonManfred said:

Really? Where?

Click to expand...

Here is one:
https://www.namecheap.com/security/ssl-certificates/comodo/positivessl.aspx

Erel said:

1. You can manually add the self signed certificate to the computer trust store. This is done for example in B4i to support the builders.
This is secure and doesn't require any code change.

Click to expand...

Is this to be done on the server (broker) side. I run mosquitto on Raspberry Pi

Erel said:

2. Configure the client to ignore the certificate (similar to Http.InitializeAcceptAll). This solution doesn't offer real security.
If you like to add this option to MqttClient then start a new thread for this in the wishlist forum.

Click to expand...

As I understand the data is still encrypted, but we miss ssl authentication?
If so, i'll make a request for it, i think it can be usefull for others as well...

Erel said:

You can instead use B4XCipher to encrypt some or all of the messages.

Click to expand...

I was thinking of using B4XCipher for the payload encryption as an additional protection in application layer.

woniol said:

Is this to be done on the server (broker) side. I run mosquitto on Raspberry Pi

Click to expand...

On the client.

woniol said:

As I understand the data is still encrypted, but we miss ssl authentication?

Click to expand...

The data is encrypted but the protection is fragile and open to man in the middle attacks.