blakeblackshear / blakeblackshear/frigate
[Support]: MQTT Configuration does not support MQTTS without self-signed certs
- Dominant language
- TypeScript
- Stars
- 35.9k
- Forks
- 3.6k
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 122
Description
### Describe the problem you are having
I was trying to get Frigate to connect to my MQTT server that uses a certificate from Let's Encrypt (not self signed). When I run Frigate without setting tls_ca_certs, Frigate does not connect to my MQTT server and displays not log output related to MQTT. If I set tls_ca_certs to the default certificate authority file (`/etc/ssl/certs/ca-certificates.crt`), it connects properly.
I did some digging around the code and found [this line](https://github.com/blakeblackshear/frigate/blob/c492b30adbef6d64187db3e512a59891ed27839e/frigate/mqtt.py#L141) that controls enabling SSL/TLS with paho-mqtt. It does not call `tls_set` unless a value for tls_ca_certs is provided. Referring to the [documentation ](https://pypi.org/project/paho-mqtt/#tls-set)for this function, it states that if you call it without providing a value for ca_certs on Python 3.4+, it will use the default certificate authority of the system.
The configuration should be changed to allow for a secure flag to be set to enable SSL/TLS without providing a certificate authority or updating the documentation to indicate that you need to use a default value of `/etc/ssl/certs/ca-certificates.crt` (For Ubuntu 20.04)
### Version
0.9.4-26ae608
### Frigate config file
```yaml
mqtt:
host:
port: 8883
user: frigate
password:
# Without this line it doesn't work
tls_ca_certs: /etc/ssl/certs/ca-certificates.crt
cameras:
front_door:
ffmpeg:
inputs:
- path: rtsp://admin:pass@10.42.50.20:554/h264Preview_01_sub
roles:
- detect
- rtmp
- record
detect:
width: 640
height: 480
fps: 7
```
### Relevant log output
```shell
N/A
```
### FFprobe output from your camera
```shell
N/A
```
### Frigate stats
```json
N/A
```
### Operating system
Debian
### Install method
Docker Compose
### Coral version
CPU (no coral)
### Network connection
Wired
### Camera make and model
Reolink 520
### Any other information that may be helpful
Really cool project and just wanted to fix this for anyone else who might have the same problem as I couldn't find anything online.
Contributor guide
Research direction
Start in frigate/mqtt.py around the tls_set call at line 141 and compare its behavior with the paho-mqtt tls_set documentation. Reproduce the provided MQTT configuration against a server using a Let's Encrypt certificate, then verify that the chosen configuration or documentation makes this secure connection work without requiring an explicit system CA path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend, networking
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100