Student here, first post. I’m doing a soil moisture logger for a lab project: Pi 3, capacitive sensor via an ADS1115, paho-mqtt 1.6, sending to Hermetry on 8883. On my home Wi-Fi everything works. In the lab it fails every time:
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED]
certificate verify failed: certificate is not yet valid (_ssl.c:1006)The lab network blocks a lot of things, so I also tried connecting to the broker’s IP instead of the host name (I resolved it at home and hardcoded it) and then the error changes to a hostname mismatch. I’ve reinstalled certifi and called client.tls_set() with and without the ca_certs path. Nothing helps. Is it the lab firewall messing with TLS?
Is 8883 even open on that network? Some places only allow 80 and 443 out.
It must be open, the handshake starts, it just fails on the certificate.
Maybe you need a client certificate for the broker? We had to load one on our line PCs.
What does date say on the Pi when you’re in the lab?
…it says March of last year. At home it’s right.
That’s it then. A Pi 3 has no real time clock. At boot it restores the time it saved at the last clean shutdown (fake-hwclock) and then waits for NTP. Your lab network blocks NTP (UDP 123), so the clock stays in the past, and to the TLS library the server certificate isn’t valid yet. Seen this on half the field Pis I’ve commissioned behind locked-down firewalls.
Fixes, pick one:
# 1. ask IT for the internal NTP server and use it
sudo nano /etc/systemd/timesyncd.conf
[Time]
NTP=ntp.your-lab.example
sudo systemctl restart systemd-timesyncd
timedatectl # "System clock synchronized: yes"
# 2. if only 443 is open: sync from HTTPS headers
sudo apt install htpdate
sudo htpdate -s https://www.example.orgUndo the hardcoded IP. The broker needs SNI, so connect by host name, and the certificate is checked against that name anyway, which is why you got the mismatch. Plain client.tls_set() with the system CA bundle is fine; Tyler, no client certificate is needed for token logins, the server asks for one but doesn’t require it.
Also make the script wait for a synced clock before connecting, otherwise a reboot in the lab breaks it again. A quick loop on timedatectl show -p NTPSynchronized works. See the TLS section of MQTT.
IT gave me the internal NTP server, clock is right, host name back in, connected on the first try. Added the wait-for-sync loop to the systemd unit too. Can’t believe it was the date.
- You must be logged in to reply to this topic.
Join the conversation
Sign in to ask and answer, like helpful posts and mark the reply that solved your problem. Every contribution earns points and levels.