Configure SSL/TLS for Chariot
Summary
This tutorial explains how to configure SSL/TLS for the Chariot MQTT Server to enable secure HTTPS communication for the Chariot Web UI and secure MQTTS communication for MQTT clients. You will learn how to upload SSL certificate files, enable SSL/TLS communication, configure anonymous MQTT client connections, and manage existing SSL certificates.
⚠️ Self-signed certificates should not be used in production environments on public networks.
SSL/TLS Requirements
Chariot requires three files to configure SSL/TLS communication:
- Private Key
- Server Certificate
- Root CA Chain
Private Key
The private key is used to encrypt and decrypt SSL/TLS traffic. The private key must match the certificate used by the server.
Requirements:
- RSA private key
- PKCS1 or PKCS8 format
- PEM encoded
⚠️ PKCS8 private key support was added in Chariot v2.3.1.
Server Certificate
The server certificate is used by Chariot for HTTPS and MQTTS communication.
Requirements:
- X.509 SSL certificate
- PEM encoded
- Signed by a Certificate Authority (CA)
Root CA Chain
The CA chain establishes the chain of trust between the server certificate and the issuing Certificate Authority.
The chain file may include:
- Root CA certificate
- Intermediate CA certificates
Requirements:
- X.509 certificates
- PEM encoded
Configure SSL/TLS
Upload SSL/TLS Files
- Navigate to the Certificates page in the left-hand side bar.
- If SSL/TLS has not been configured, the system displays:
SSL Not Setup - Upload the following files using the upload icons on the right side of the page:
| Configuration Field | Description |
|---|---|
| Private Key | RSA private key used to generate the CSR |
| Certificate | Signed server certificate |
| CA Chain | Root and intermediate CA certificates |
Enable SSL/TLS
After uploading all required files, select Setup SSL.
Once completed, the uploaded certificate details and file names will be displayed.
Configure Anonymous MQTT Client Connections
Chariot MQTT Server still requires MQTT credentials for client authentication, even when TLS/SSL client certificates are used. If MQTT clients will not provide MQTT usernames and passwords, anonymous connections must be enabled.
-
Navigate to MQTT Server → Configuration under the Configuration menu.
-
Enable Allow Anonymous.
By default, anonymous MQTT clients are allowed to publish and subscribe on # unless an Anonymous MQTT Credential is configured.
An Anonymous MQTT Credential can optionally be selected from the configured MQTT Credentials to apply publish and subscribe ACLs for anonymous connections.
⚠️ A password must still be configured for the MQTT Credential, even though it will not be used for authentication.
Delete SSL/TLS Certificates
Deleting the SSL/TLS configuration removes the uploaded certificates and keys and returns Chariot to a pre-configuration state. To remove the configured SSL/TLS certificates:
-
Navigate to System → Certificates under the Configuration menu.
-
Select Delete Certificates, then Delete.
Additional Notes
Obtain a Certificate from a Certificate Authority
The general process for obtaining a CA-signed certificate is:
- Generate an RSA private key
- Create a Certificate Signing Request (CSR)
- Submit the CSR to a Certificate Authority
- Receive the signed server certificate and any intermediate certificates
When generating the CSR:
- Ensure the Common Name (CN) matches the server hostname or URL
- Do not include www if the certificate will be used for MQTT communication
See the tutorial for Obtaining SSL Certificates for more information.
Create a Self-Signed Certificate
Self-signed certificates can be used for development or private network environments.
The general process includes:
- Create the Root CA pair
- Create and sign the Intermediate CA pair
- Create and sign the Server certificate pair
When generating certificates, ensure the Common Name (CN) matches the hostname or IP address used by MQTT clients.
⚠️ Self-signed certificates are not recommended for Internet-facing production environments.