blakeblackshear / blakeblackshear/frigate

[Support]: MQTT Configuration does not support MQTTS without self-signed certs

Open Beginner friendly
#2,471 7 comments 11 reactions 0 assignees View on GitHub
enhancement planned
Dominant language
TypeScript
Stars
35.9k
Forks
3.6k
Avg merge
8h 39m
Merged PRs (30d)
122

Description

### Describe the problem you are having

I was trying to get Frigate to connect to my MQTT server that uses a certificate from Let's Encrypt (not self signed). When I run Frigate without setting tls_ca_certs, Frigate does not connect to my MQTT server and displays not log output related to MQTT. If I set tls_ca_certs to the default certificate authority file (`/etc/ssl/certs/ca-certificates.crt`), it connects properly.

I did some digging around the code and found [this line](https://github.com/blakeblackshear/frigate/blob/c492b30adbef6d64187db3e512a59891ed27839e/frigate/mqtt.py#L141) that controls enabling SSL/TLS with paho-mqtt. It does not call `tls_set` unless a value for tls_ca_certs is provided. Referring to the [documentation ](https://pypi.org/project/paho-mqtt/#tls-set)for this function, it states that if you call it without providing a value for ca_certs on Python 3.4+, it will use the default certificate authority of the system.

The configuration should be changed to allow for a secure flag to be set to enable SSL/TLS without providing a certificate authority or updating the documentation to indicate that you need to use a default value of `/etc/ssl/certs/ca-certificates.crt` (For Ubuntu 20.04)

### Version

0.9.4-26ae608

### Frigate config file

```yaml
mqtt:
host:
port: 8883
user: frigate
password:
# Without this line it doesn't work
tls_ca_certs: /etc/ssl/certs/ca-certificates.crt

cameras:
front_door:
ffmpeg:
inputs:
- path: rtsp://admin:pass@10.42.50.20:554/h264Preview_01_sub
roles:
- detect
- rtmp
- record
detect:
width: 640
height: 480
fps: 7
```

### Relevant log output

```shell
N/A
```

### FFprobe output from your camera

```shell
N/A
```

### Frigate stats

```json
N/A
```

### Operating system

Debian

### Install method

Docker Compose

### Coral version

CPU (no coral)

### Network connection

Wired

### Camera make and model

Reolink 520

### Any other information that may be helpful

Really cool project and just wanted to fix this for anyone else who might have the same problem as I couldn't find anything online.

Contributor guide

Open the contributing guide

Research direction

Start in frigate/mqtt.py around the tls_set call at line 141 and compare its behavior with the paho-mqtt tls_set documentation. Reproduce the provided MQTT configuration against a server using a Let's Encrypt certificate, then verify that the chosen configuration or documentation makes this secure connection work without requiring an explicit system CA path.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, networking
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.