I think you might need to set port: 8883 somewhere.
I also set proto_ver: :v5, client_id: <string>, and clean_start: false, although I would like to think these values are optional (not tested though).
According to the docs proto_ver defaults to :v4, not :v5 which might be desirable.
that’s default for SSL, see: emqtt_cli.erl#L337.
I’m using the exact same opts the cli uses.
You got SSL running right?
Can you check if it works in docker?
Your theory makes sense. But if I don’t specify port: 8883 I get symptoms that look identical to what you observed. Which is somewhat weird and confusing.
… Oh wait, that default is only applicable for the CLI I think.
OK thats super stupid. 
Its working! Who would have thought, you just have to do it right. 
def test_8883 do
opts = [
host: 'test.mosquitto.org',
port: 8883,
ssl: true,
ssl_opts: [cacertfile: "mosquitto.org.crt"]
]
{:ok, pid} = :emqtt.start_link(opts)
{:ok, _} = :emqtt.connect(pid)
{:ok, _, _} = :emqtt.subscribe(pid, %{}, [{"test/#", []}])
end
And here is code for “8884 : MQTT, encrypted, client certificate required”.
You need to Generate a TLS client certificate for test.mosquitto.org first
def test_8884 do
opts = [
host: 'test.mosquitto.org',
port: 8884,
ssl: true,
ssl_opts: [
cacertfile: "mosquitto.org.crt",
certfile: "client.crt",
keyfile: "client.key"
]
]
{:ok, pid} = :emqtt.start_link(opts)
{:ok, _} = :emqtt.connect(pid)
{:ok, _, _} = :emqtt.subscribe(pid, %{}, [{"test/#", []}])
end
OK, I think I understand why I need to override the server_name_indication value. And understand a bit more about the erlang debugger.
Normally a program would use ssl:connect(Host, Port, Options, Timeout) which would create the TCP connection to the host. But emqtt doesn’t do that, it creates the TCP connection and then calls ssl:connect(Sock, SslOpts2, Timeout) on the existing sock connection. As a result the ssl module has no way of knowing what the original hostname was for the original connection.
https://github.com/emqx/emqtt/blob/master/src/emqtt_sock.erl#L53
https://github.com/emqx/emqtt/blob/master/src/emqtt_sock.erl#L64
This behaviour is in the documentation for ssl:connect/2 in fact. ssl — OTP 29.0.2 (ssl 11.7.2)
If the option verify is set to verify_peer the option server_name_indication shall also be specified, if it is not no Server Name Indication extension will be sent, and public_key:pkix_verify_hostname/2 will be called with the IP-address of the connection as ReferenceID, which is probably not what you want.
I am starting to think however that emqtt should really supply that value itself, if it wasn’t already supplied.
Sometimes things in emqtt can be inconsistent. For example, the type spec for the handlers says:
disconnected := fun(({reason_code(), _Properties :: term()}) → any()) | mfas()
Implies the disconnected handler is called as disconnected({reason, properties}). But sometimes it is called as disconnected(error) without the tuple and a completely different type.
https://github.com/emqx/emqtt/blob/master/src/emqtt.erl#L1052
I have seen it being called both ways in my test code.
Seems like the definition of return_code() isn’t correct. Should be an integer according to the definition. But I get values like:
:shutdown - on certificate validation error.{:badmatch, :ok} - elixir exception generated in linked process.Not sure if this will always be the case or not however.
I can connect to all the ports mosquittos testserver offers. IPV6 and SSL do not work together …!?
I’ve omitted websockets because emqtt does not support TLS for websockets.
I’ve tested with version 1.2.0 because I suddenly can’t build 1.4.0 anymore, there is sth wrong with the quicer submodule.
defmodule MqttHowtoTest do
use ExUnit.Case
@hostname 'test.mosquitto.org'
@host [host: @hostname]
@credentials [username: "rw", password: "readwrite"]
@ssl_opts [
cacertfile: "mosquitto.org.crt",
server_name_indication: @hostname,
verify: :verify_peer
]
@client_cert [certfile: "client.crt", keyfile: "client.key"]
@ipv6 [tcp_opts: [:inet6]]
@opts_1883 @host ++ [port: 1883]
@opts_1884 @host ++ @credentials ++ [port: 1884]
@opts_8883 @host ++ [ssl: true, ssl_opts: @ssl_opts, port: 8883]
@opts_8884 @host ++ [ssl: true, ssl_opts: @ssl_opts ++ @client_cert, port: 8884]
@opts_8885 @host ++ @credentials ++ [ssl: true, ssl_opts: @ssl_opts, port: 8885]
def connect(opts) do
{:ok, pid} = :emqtt.start_link(opts)
:emqtt.connect(pid)
end
test "1883" do
assert {:ok, _} = connect(@opts_1883)
end
test "1884" do
assert {:ok, _} = connect(@opts_1884)
end
test "8883" do
assert {:ok, _} = connect(@opts_8883)
end
test "8884" do
assert {:ok, _} = connect(@opts_8884)
end
test "8885" do
assert {:ok, _} = connect(@opts_8885)
end
test "1883 ipv6" do
assert {:ok, _} = connect(@opts_1883 ++ @ipv6)
end
test "1884 ipv6" do
assert {:ok, _} = connect(@opts_1884 ++ @ipv6)
end
# these will not work: ** (EXIT from #PID<0.212.0>) :econnrefused
# test "8883 ipv6" do
# assert {:ok, _} = connect(@opts_8883 ++ @ipv6)
# end
# test "8884 ipv6" do
# assert {:ok, _} = connect(@opts_8884 ++ @ipv6)
# end
# test "8885 ipv6" do
# assert {:ok, _} = connect(@opts_8885 ++ @ipv6)
# end
end