OQS_Provider with MQTT

[NarjasHadjer]

I am working on integrating OQS_Provider with MQTT on a Raspberry Pi 3B+. I have created the CA and the server certificate, and I have signed it with the CA. However, when I start Mosquitto, it returns the error: OpenSSL Error[0]: error:0A0000F7
routines::unknown certificate type (Sorry, I can't take screenshots on the Raspberry Pi because it's buggy, but I will provide the openssl.cnf and mosquitto.cnf configuration files and i took pictures with my phone

openssl.cnf : i added these lines to the default configuration

[provider_sect]
legacy = legacy_sect
oqsprovider = oqsprovider_sect
[default_sect]
activate = 1
[legacy_sect]
activate = 1
[oqsprovider_sect]
activate = 1
[openssl_init]
providers = provider_sect
ssl_conf = ssl_sect
[ssl_sect]
system_default = system_default_sect
[system_default_sect]
CipherString = DEFAULT:@SECLEVEL=2 ( i put here 0, cause i had an error : ca md too weak when i tried to run mosquitto first time)
Groups = kyber768:kyber1024

mosquitto.conf : I added these lines to the default configuration

istener 1883
listener 8883
protocol mqtt
cafile /home/narjas/certif/Certificate_CA.crt
keyfile /home/narjas/certif/Server.key
certfile /home/narjas/certif/Certificate.crt
use_identity_as_username true
require_certificate true

tls_version tlsv1.3

And even when i run the test given, i get the same error :

[baentsch]

This error message indicates most likely that oqsprovider is not active. Please proceed as per the bug reporting template by asking your setup to report actual provider availability (openssl list -providers) and ensure oqsprovider is listed. Maybe @aniket-rulez can provide hands-on help as per #443 (comment).

[NarjasHadjer]

The OQS_Provider is active, i can use post-quantum algorithms to create keys, and sign data, certificates ...., but when i activate TLS on MQTT, the server fails to start, indicating the error : unknown certificates, i tried everything, but still get the same error !

[baentsch]

Have you looked at the Mosquitto demo integration code on oqs-demos to check for non-obvious config differences between your setup and the one there?

[NarjasHadjer]

Yes, but I think I’ll redo everything with a newer version of OpenSSL, as I’ve seen recommended in other discussions. In fact, there are even some algorithms I haven’t been able to use. Thank you for your response. If I encounter the same error again, it must be due to another cause.

[baentsch]

I’ll redo everything with a newer version of OpenSSL

If you want to use TLS sigs, indeed 3.2 is the minimum.