title: VerneMQ TLS configuration gives error handshake failed using letsencrypt
body: <p>I am running vernerMQ on a VPS with ubuntu 18.04 as OS, I made certification using OpenSSL then copied the cert files from
  /etc/letsencrypt/live/$mydomain/*.pem
  to
  /etc/vernemq/
  I am using this configuration for SSL:</p>
  <pre><code>listener.ssl.cafile = /etc/vernemq/chain.pem
  listener.ssl.certfile = /etc/vernemq/cert.pem
  listener.ssl.keyfile = /etc/vernemq/privkey.pem
  
  listener.ssl.default = 0.0.0.0:8883
  </code></pre>
  <p>User and password is set in a passwd file.
  the problem is when I try to connect to the server from an esp8266, it gives me this error:</p>
  <pre><code>BSSL:_wait_for_handshake: failed
  BSSL:Couldn't connect. Error = 'Unknown error code.'
  </code></pre>
  <p>here is the esp8266 code:</p>
  <pre><code>#include &lt;ESP8266WiFi.h&gt;
  #include&lt;WiFiManager.h&gt;
  #include &lt;PubSubClient.h&gt;
  #include &lt;ArduinoJson.h&gt;
  
  //Enter your wifi credentials
  const char* ssid = &quot;ssid&quot;;  
  const char* password =  &quot;ssidpass&quot;;
  
  // A name for our device
  const char* deviceName = &quot;devicename&quot;;
  
  // Our mqtt server Adress and port
  const char* mqttServer = &quot;mydomain&quot;;
  const int mqttPort = 8883;
  
  // a user defined on our server with it's password for login purpose
  const char* mqttUser = &quot;user&quot;; //User
  const char* mqttPassword = &quot;pass&quot;; //Password
  
  // our gpio
  #define ESP8266_LED (0)
  
  // this is ca Certificate used as SSL key
  const char caCert[] PROGMEM = R&quot;EOF(
  -----BEGIN CERTIFICATE-----
      cert content : cert.pem
  -----END CERTIFICATE-----
  )EOF&quot;;
  
  /* MQTT broker cert SHA1 fingerprint, used to validate connection to right server */
  const char mqttCertFingerprint[] = &quot;fingerprint&quot;;
       
  /* Other globals */
  X509List caCertX509(caCert);        /* X.509 parsed CA Cert */
  WiFiClientSecure espClient;         /* Secure client connection class, as opposed to WiFiClient */
  PubSubClient mqttClient(espClient); /* MQTT Client connection */
  String clientId = &quot;ESP8266Client-&quot;; /* MQTT client ID (will add random hex suffix during setup) */
  
  
  
  void setup() {
      Serial.begin(115200);
    
    // prepare GPIO0
    pinMode(0, OUTPUT);
   // digitalWrite(0, LOW);
  
  
    WiFi.mode(WIFI_STA);
    WiFi.begin(ssid, password);
  
  /*#ifdef SERIAL_DEBUG*/
    Serial.print(&quot;Connecting&quot;);
  /*#endif*/
    while (WiFi.status() != WL_CONNECTED)
    {
      delay(500);
  /*#ifdef SERIAL_DEBUG*/
      Serial.print(&quot;.&quot;);
  /*#endif*/
    }
  /*#ifdef SERIAL_DEBUG*/
    /* When WiFi connection is complete, debug log connection info */
    Serial.println();
    Serial.print(&quot;Connected, IP address: &quot;);
    Serial.println(WiFi.localIP());
    setClock();
  /*#endif*/
   /* Configure secure client connection */
    espClient.setTrustAnchors(&amp;caCertX509);         /* Load CA cert into trust store */
    espClient.allowSelfSignedCerts();               /* Enable self-signed cert support */
    espClient.setFingerprint(mqttCertFingerprint);  /* Load SHA1 mqtt cert fingerprint for connection validation */
    
    /* Optionally do none of the above and allow insecure connections.                                             
     * This will accept any certificates from the server, without validation and is not recommended.
     */
    //espClient.setInsecure();
  
   /* #ifdef TLS_DEBUG
    /* Call verifytls to verify connection can be done securely and validated - this is optional but was useful during debug */
    verifytls();
  /*#endif
    /* Configure MQTT Broker settings */
    mqttClient.setServer(mqttServer,mqttPort);
    mqttClient.setCallback(subCallback);
  
      /* Add random hex client ID suffix once during each reboot */
    clientId += String(random(0xffff), HEX); 
  
  }
  
  
  
  void loop() {
      /* Main loop. Attempt to re-connect to MQTT broker if connection drops, and service the mqttClient task. */
    if(!mqttClient.connected()) {
      reconnect();
    }
    mqttClient.loop();
  }
  
  /*#ifdef TLS_DEBUG
  /* verifytls()
   *  Test WiFiClientSecure connection using supplied cert and fingerprint
   */
  bool verifytls() {
    bool success = false;
      
  /*#ifdef SERIAL_DEBUG*/
    Serial.print(&quot;Verifying TLS connection to &quot;);
    Serial.println(mqttServer);
  /*#endif*/
  
    success = espClient.connect(mqttServer, mqttPort);
  
  /*#ifdef SERIAL_DEBUG*/
    if (success) {
      Serial.println(&quot;Connection complete, valid cert, valid fingerprint.&quot;);
    }
    else {
      Serial.println(&quot;Connection failed!&quot;);
    }
  /*#endif*/
  
    return (success);
  }
  /*#endif*/
  
  void reconnect() {
    /* Loop until we're reconnected */
    while (!mqttClient.connected()) {
  /*#ifdef SERIAL_DEBUG*/
      Serial.print(&quot;Attempting MQTT broker connection...&quot;);
  /*#endif*/
      /* Attempt to connect */
      if (mqttClient.connect(clientId.c_str(),mqttUser,mqttPassword)) {
  /*#ifdef SERIAL_DEBUG*/
        Serial.println(&quot;connected&quot;);
  /*#endif*/
        /* Once connected, resubscribe */
        mqttClient.subscribe(&quot;user/home1/esponoff&quot;);      
      } 
      else {
  /*#ifdef SERIAL_DEBUG*/
        Serial.print(&quot;Failed, rc=&quot;);
        Serial.print(mqttClient.state());
        Serial.println(&quot;. Trying again in 5 seconds...&quot;);
  /*#endif
        /* Wait 5 seconds between retries */
        delay(5000);
      }
    }
  }
  
  // Set time via NTP, as required for x.509 validation
  void setClock() {
    //get the time
  }
  
  void subCallback(char *topic, byte *payload, unsigned int length)
  {
   //to do
  }
  </code></pre>
  <p>the same config is working with mosquitto but not with verneMQ</p>