From 74b8340afb7c185de1f3776d94282399a9f9bdd2 Mon Sep 17 00:00:00 2001
From: Andreas Brett <andreasbrett@users.noreply.github.com>
Date: Wed, 10 Jul 2019 17:57:41 +0200
Subject: [PATCH] add TLS/SSL options for connecting to MQTT server (#1706)

* add TLS/SSL options for connecting to MQTT server

* Update mqtt.js

* gotta love travis

* Update mqtt.js

separated processing of mqtt.ca and mqtt.key/mqtt.cert in order to allow for "server-authentication only" as well as "server+client authentication"

* Update mqtt.js
---
 lib/mqtt.js | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/lib/mqtt.js b/lib/mqtt.js
index 0e72b9436..910c7031c 100644
--- a/lib/mqtt.js
+++ b/lib/mqtt.js
@@ -1,6 +1,7 @@
 const mqtt = require('mqtt');
 const logger = require('./util/logger');
 const settings = require('./util/settings');
+const fs = require('fs');
 
 class MQTT {
     constructor() {
@@ -21,6 +22,32 @@ class MQTT {
             },
         };
 
+        if (mqttSettings.ca) {
+            logger.debug(`MQTT SSL/TLS: Path to CA certificate = ${mqttSettings.ca}`);
+            const ca = fs.readFileSync(mqttSettings.ca);
+
+            if (ca) {
+                options.ca = ca;
+            } else {
+                logger.error(`Error loading CA certificate for MQTT SSL/TLS configuration.`);
+            }
+        }
+
+        if (mqttSettings.key && mqttSettings.cert) {
+            logger.debug(`MQTT SSL/TLS: Path to client key = ${mqttSettings.key}`);
+            logger.debug(`MQTT SSL/TLS: Path to client certificate = ${mqttSettings.cert}`);
+
+            const key = fs.readFileSync(mqttSettings.key);
+            const cert = fs.readFileSync(mqttSettings.cert);
+
+            if (key && cert) {
+                options.key = key;
+                options.cert = cert;
+            } else {
+                logger.error(`Error loading key and/or certificate for MQTT SSL/TLS client authentication.`);
+            }
+        }
+
         if (mqttSettings.user && mqttSettings.password) {
             options.username = mqttSettings.user;
             options.password = mqttSettings.password;