Ubuntu上Mosquitto配置Let's Encrypt证书启动失败求助

错误信息 #

ubuntu@ip-172-31-37-161:~$ sudo systemctl status mosquitto.service
× mosquitto.service - Mosquitto MQTT Broker
     Loaded: loaded (/lib/systemd/system/mosquitto.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Mon 2023-01-02 18:36:02 UTC; 10min ago
       Docs: man:mosquitto.conf(5)
             man:mosquitto(8)
    Process: 7652 ExecStartPre=/bin/mkdir -m 740 -p /var/log/mosquitto (code=exited, status=0/SUCCESS)
    Process: 7653 ExecStartPre=/bin/chown mosquitto /var/log/mosquitto (code=exited, status=0/SUCCESS)
    Process: 7654 ExecStartPre=/bin/mkdir -m 740 -p /run/mosquitto (code=exited, status=0/SUCCESS)
    Process: 7655 ExecStartPre=/bin/chown mosquitto /run/mosquitto (code=exited, status=0/SUCCESS)
    Process: 7656 ExecStart=/usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf (code=exited, status=1/FAILURE)
   Main PID: 7656 (code=exited, status=1/FAILURE)
        CPU: 14ms

Jan 02 18:36:02 ip-172-31-37-161 systemd[1]: mosquitto.service: Main process exited, code=exited, status=1/FAILURE
Jan 02 18:36:02 ip-172-31-37-161 systemd[1]: mosquitto.service: Failed with result 'exit-code'.
Jan 02 18:36:02 ip-172-31-37-161 systemd[1]: Failed to start Mosquitto MQTT Broker.
Jan 02 18:36:02 ip-172-31-37-161 systemd[1]: mosquitto.service: Scheduled restart job, restart counter is at 5.
Jan 02 18:36:02 ip-172-31-37-161 systemd[1]: Stopped Mosquitto MQTT Broker.
Jan 02 18:36:02 ip-172-31-37-161 systemd[1]: mosquitto.service: Start request repeated too quickly.
Jan 02 18:36:02 ip-172-31-37-161 systemd[1]: mosquitto.service: Failed with result 'exit-code'.
Jan 02 18:36:02 ip-172-31-37-161 systemd[1]: Failed to start Mosquitto MQTT Broker.

当前conf.d配置文件内容 #

allow_anonymous false

password_file /etc/mosquitto/passwd

listener 1883
#NON SECURE PORT

listener 1884
certfile /etc/letsencrypt/live/domain.com/cert.pem
cafile /etc/letsencrypt/live/domain.com/chain.pem
keyfile /etc/letsencrypt/live/domain.com/privkey.pem

问题现象：注释或移除keyfile配置后，Mosquitto代理可正常运行且无报错。

排查与解决步骤 #

1. 检查私钥文件权限 #

Mosquitto以mosquitto用户身份运行，需确保该用户能读取私钥文件及上级目录：

# 查看文件权限与所属
ls -l /etc/letsencrypt/live/domain.com/privkey.pem
ls -ld /etc/letsencrypt/live/domain.com/
ls -ld /etc/letsencrypt/archive/domain.com/

若权限不足，执行以下命令添加读取权限：

sudo setfacl -R -m u:mosquitto:rX /etc/letsencrypt/live/domain.com/
sudo setfacl -R -m u:mosquitto:rX /etc/letsencrypt/archive/domain.com/

2. 验证私钥文件有效性 #

私钥文件可能损坏或格式错误，用openssl检查：

openssl rsa -in /etc/letsencrypt/live/domain.com/privkey.pem -check

若报错，重新生成Let's Encrypt证书：

sudo certbot renew --force-renewal

3. 手动启动查看详细错误 #

systemctl状态信息不够详细，手动启动Mosquitto获取调试日志：

sudo /usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf -v

输出会显示具体错误原因（如权限不足、文件路径错误、证书不匹配等），根据提示针对性修复。

4. 检查Mosquitto版本兼容性 #

旧版本Mosquitto对TLS配置可能存在兼容性问题，确认当前版本：

mosquitto -v

若版本低于2.0，建议升级：

sudo apt update && sudo apt upgrade mosquitto

内容的提问来源于stack exchange，提问作者AbheshekSharma