Paho MQTT连接Mosquitto时遇SSL EOF协议违规错误求助

问题概述 #

Docker部署eclipse-mosquitto作为MQTT Broker，使用Python Paho客户端连接时出现以下错误：

Traceback (most recent call last):
  File "/home/kali/mqtt-broker/scripts/sub.py", line 27, in <module>
    client.connect( broker_address, 8883, 60 )
  File "/home/kali/.local/lib/python3.11/site-packages/paho/mqtt/client.py", line 914, in connect
    return self.reconnect()
           ^^^^^^^^^^^^^^^^
  File "/home/kali/.local/lib/python3.11/site-packages/paho/mqtt/client.py", line 1073, in reconnect
    sock.do_handshake()
  File "/usr/lib/python3.11/ssl.py", line 1346, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLEOFError: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1002)

已排查SAN/CN依赖、证书CN匹配、Python SSL依赖包等问题，仍未解决。

关键配置回顾 #

Broker配置（mosquitto.conf） #

persistence true
persistence_location /mosquitto/data/
log_dest file /mosquitto/log/mosquitto.log
allow_anonymous true
listener 8883 127.0.0.1

cafile /mosquitto/config/certs/ca.crt
certfile /mosquitto/config/certs/server.crt
keyfile /mosquitto/config/certs/server.key
tls_version tlsv1.2

Docker Compose配置 #

version: '3.5'

services:
  mosquitto:
    container_name: mos2-tls
    image: eclipse-mosquitto:latest
    volumes:
      - ./config:/mosquitto/config/
    ports:
      - '8883:8883'
    networks:
      - default
    restart: unless-stopped

networks:
  default:

Python客户端核心代码 #

client = mqtt.Client( "mqttclient" )
client.tls_set(ca_cert,client1_cert,client1_key, tls_version=ssl.PROTOCOL_TLSv1_2)
client.tls_insecure_set(False)
client.connect( broker_address, 8883, 60 )

解决方案步骤 #

1. 修复Docker卷挂载缺失问题 #

Mosquitto需要data和log目录存储持久化数据和日志，当前Docker Compose仅挂载了config目录，导致Broker启动时可能因无法创建文件而异常。

• 修改docker-compose.yml，添加data和log目录挂载：

volumes:
  - ./config:/mosquitto/config/
  - ./data:/mosquitto/data/
  - ./log:/mosquitto/log/

• 创建本地目录并设置权限：

mkdir -p data log
chmod 777 data log

2. 修正证书文件权限 #

容器内Mosquitto进程以UID/GID 1883运行，需确保证书文件能被读取：

chmod -R 644 config/certs/
chown -R 1883:1883 config/certs/

3. 调整Broker TLS配置 #

根据是否需要双向TLS（客户端证书验证）修改配置：

• 无需双向TLS：添加require_certificate false，允许匿名客户端通过TLS连接：

listener 8883 127.0.0.1
cafile /mosquitto/config/certs/ca.crt
certfile /mosquitto/config/certs/server.crt
keyfile /mosquitto/config/certs/server.key
tls_version tlsv1.2
require_certificate false

• 需要双向TLS：确保客户端证书由同一CA签发，并添加require_certificate true，同时禁用allow_anonymous：

allow_anonymous false
listener 8883 127.0.0.1
cafile /mosquitto/config/certs/ca.crt
certfile /mosquitto/config/certs/server.crt
keyfile /mosquitto/config/certs/server.key
tls_version tlsv1.2
require_certificate true
use_identity_as_username true

4. 客户端代码适配 #

• 无需双向TLS：移除客户端证书和密钥的传入，仅保留CA证书用于验证Broker：

client.tls_set(ca_cert, tls_version=ssl.PROTOCOL_TLSv1_2)

• 需要双向TLS：确保客户端证书client.crt和密钥client.key由配置的CA签发，且格式为PEM。

5. 检查Broker启动日志 #

进入容器查看日志，确认Broker无启动异常：

docker exec -it mos2-tls cat /mosquitto/log/mosquitto.log

若日志中出现证书读取失败、权限错误等信息，对应修复后重启Broker。

6. 重启服务并验证 #

docker-compose down
docker-compose up -d

重新运行Python客户端代码，检查是否成功连接并收发消息。

内容的提问来源于stack exchange，提问作者Souf