# Mosquitto MQTT and TLS without client HostSNI

**URL:** <https://community.traefik.io/t/mosquitto-mqtt-and-tls-without-client-hostsni/21912>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [March 18, 2024, 4:58pm UTC](https://community.traefik.io/t/mosquitto-mqtt-and-tls-without-client-hostsni/21912 "2024-03-18T16:58:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ZeGuigui](https://avatars.discourse-cdn.com/v4/letter/z/2bfe46/32.png) [@ZeGuigui](https://community.traefik.io/u/ZeGuigui)\
**Post date:** [March 18, 2024, 4:58pm UTC](https://community.traefik.io/t/mosquitto-mqtt-and-tls-without-client-hostsni/21912/1 "2024-03-18T16:58:56Z")

</div>

Hello

I am trying to setup a mosquitto MQTT server behind Traefik. The problem is most clients lack the SNI feature (like `mosquitto_pub` used for testing !).

Here is my `docker-compose` file:

```auto
version: "3.0"
services:
  mosquitto:
    image: eclipse-mosquitto:latest
    container_name: mosquitto
    restart: always
    volumes:
      - ./config/mosquitto.conf:/mosquitto/config/mosquitto.conf
      - ./config/passwd:/mosquitto/passwd
      - ./data:/mosquitto/data
      - ./logs:/mosquitto/log
    expose:
      - 1883
    labels:
      - "traefik.enable=true"
      - "traefik.tcp.routers.mqtt.entrypoints=mqtt"
      - "traefik.tcp.routers.mqtt.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.mqtt.service=mqtt-srv"
      - "traefik.tcp.routers.mqtts.entrypoints=mqttsecure"
      - "traefik.tcp.routers.mqtts.rule=HostSNI(`*`)"
      - "traefik.tcp.routers.mqtts.tls.certresolver=certs"
      - "traefik.tcp.routers.mqtts.tls.domains[0].main=*.example.com"
      - "traefik.tcp.routers.mqtts.tls.passthrough=false"
      - "traefik.tcp.routers.mqtts.tls.options=nonstrictsni@file"
      - "traefik.tcp.routers.mqtts.service=mqtt-srv"
      - "traefik.tcp.services.mqtt-srv.loadbalancer.server.port=1883"
    networks:
      - proxy

networks:
  proxy:
    external: true

```

with `nonstrictsni` dynamic configuration:

```auto
tls:
  options:
    nonstrictsni:
      sniStrict: false

```

Then I try to publish with this:

```auto
mosquitto_sub -L mqtts://user:password@mqtt.example.com/topic

```

I get an error:

```auto
Error: A network protocol error occurred when communicating with the broker.

```

Using a non secure protocol everything is fine. Connecting with `openssl s_client` works fine and I get my wildcard certificate.

I found similar topics and tryed many variations on my setup but found nothing working. Any idea?

Thanks

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [March 19, 2024, 6:57am UTC](https://community.traefik.io/t/mosquitto-mqtt-and-tls-without-client-hostsni/21912/2 "2024-03-19T06:57:05Z")

</div>

Share your full Traefik static and dynamic config, and `docker-compose.yml` if used.

If your client can’t do `HostSNI`, maybe it can’t do TLS 1.3, which is Traefik default. Check [doc](https://doc.traefik.io/traefik/https/tls/#maximum-tls-version) to change it.

---

<div class="post-metadata">

**Author:** ![ZeGuigui](https://avatars.discourse-cdn.com/v4/letter/z/2bfe46/32.png) [@ZeGuigui](https://community.traefik.io/u/ZeGuigui)\
**Post date:** [March 19, 2024, 8:52am UTC](https://community.traefik.io/t/mosquitto-mqtt-and-tls-without-client-hostsni/21912/3 "2024-03-19T08:52:05Z")

</div>

Thanks

I have 3 majors clients:

- ownTracks on Android - connection successful 👍
- ownTracks on iOS - connection successful 👍
- mosquitto MQTT itself in a bridged configuration. That one I was worried about because command line tools were not working but, surprisingly, it's OK 👍

The only clients that are not working are `mosquitto_pub` and `mosquitto_sub` (`v1.6.9`, a bit old, that might explain, on an ubuntu 20.04) and I have no daily usage of those so I will not spend too much of my time on this issue (but lost some trying to test with those tools when everything was fine for other clients!)

Nevertheless here is my full config:

```auto
# docker-compose for traefik
version: "3.3"

secrets:
  gandi_api_key:
    file: "./secrets/gandi_api_key.secret"

services:
  traefik:
    image: "traefik:v2.11"
    container_name: "traefik"
    ports:
      - "80:80"
      - "443:443"                                                                                                          
      - "1883:1883"
      - "8883:8883"
    secrets:
      - "gandi_api_key"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/srv/traefik/acme.json:/acme.json"
      - "/srv/traefik/services:/etc/traefik/services"
      - "/srv/traefik/traefik.yaml:/etc/traefik/traefik.yaml"
    environment:
      - "GANDIV5_PERSONAL_ACCESS_TOKEN_FILE=/run/secrets/gandi_api_key"
    restart: always
    labels:
      - "traefik.enable=true"
      - "traefik.http.middlewares.auth.basicauth.users=admin:<edited>"
      - "traefik.http.routers.traefikapi.entrypoints=websecure,web"
      - "traefik.http.routers.traefikapi.middlewares=auth"
      - "traefik.http.routers.traefikapi.rule=Host(`traefik.example.com`)"
      - "traefik.http.routers.traefikapi.service=api@internal"
      - "traefik.http.routers.traefikapi.tls=true"
      - "traefik.http.routers.traefikapi.tls.certresolver=certs"
      - "traefik.http.routers.traefikapi.tls.domains[0].main=*.example.com"
    networks:
      - proxy

networks:
  proxy:
    name: "proxy

```

```auto
# traefik.yaml
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          priority: 1000000
  websecure:
    address: ":443"
  mqtt:
    address: ":1883"
  mqttsecure:
    address: ":8883"

api:
  dashboard: true

log:
  level: WARN

providers:
  docker:
    exposedByDefault: false
  file:
    directory: "/etc/traefik/services"

certificatesResolvers:
  certs:
    acme:
      email: "letsencrypt@example.com"
      storage: acme.json
      dnsChallenge:
        provider: gandiv5

```

Dynamic file for SNI already provided but from another thread it seems to be the default configuration.

Docker compose for starting mosquitto already provided!