Difficulty using client_cert authentication

[Radagan]

I have mqtts working with my mqtt endpoint callback client with other authentication methods, but not client_cert with the tools broker.

The docs don't yet cover this authentication method, only the basic mqtts here:
https://redboltz.github.io/async_mqtt/doc/latest/async_mqtt/tutorial/create_endpoint.html

as::io_context ioc;

am::tls::context ctx{am::tls::context::tlsv12};
ctx.set_verify_mode(am::tls::verify_none);
// If you want to check server certificate, set cacert as follows.
// ctx.load_verify_file(cacert);

auto amep = am::endpoint<am::role::client, am::protocol::mqtts>{
    am::protocol_version::v5, // choose MQTT version v3_1_1 or v5
    ioc.get_executor(),  // args for underlying layer (as::ssl::stream<mqtt>)
    ctx
};

I looked at the client_cli app and I noticed that it was setting these:

ctx.use_certificate_chain_file(vm["certificate"].as<std::string>());
ctx.use_private_key_file(vm["private_key"].as<std::string>(), boost::asio::ssl::context::pem);

I made these additions to the client context used to connect.

I'm not sure if I still need to set the username to "cid1" or if it being the CN is all that is required. But I still get this error either way:

Broker: TLS handshake error: certificate verify failed (SSL routines)

I'm using the certs in your test directory. The CN of the client cert shows as "cid1" and I have it in my auth_file as:

...
         "authentication": [
		{
			"name": "anonymous",
			"method": "anonymous"
		},
		{
			"name": "unauthenticated",
			"method": "unauthenticated"
		},
		{
			"name": "u1",
			"method": "sha256",
			"salt": "salt",
			"digest": "38ea2e5e88fcd692fe177c6cada15e9b2db6e70bee0a0d6678c8d3b2a9aae2ad"
		},
		{
			"name": "cid1",
			"method": "client_cert"
		},
		{
			"name": "elrond-test",
			"method": "plain_password",
			"password": "Test12345678"
		}
	],
	"group": [
		{
			"name": "@casual",
			"members": [
				"anonymous",
				"unauthenticated",
				"elrond-test",
				"cid1"
			]
		},
		{
			"name": "@g1",
			"members": [
				"u1"
			]
		}
	]
...

Can you describe the proper way to configure the client side for client_cert authentication?

I feel I'm missing something basic in the configuration.

[redboltz]

Check (and run) this test.

async_mqtt/test/system/st_mqtts_connect.cpp

Line 230 in 77c19ef

BOOST_AUTO_TEST_CASE(coro_client_cert) {

The broker is spawned as a child process and the broker read the following files:
https://github.com/redboltz/async_mqtt/blob/77c19ef126793cb9a801430e33e1c1ce3aa16198/test/system/st_auth.json
https://github.com/redboltz/async_mqtt/blob/77c19ef126793cb9a801430e33e1c1ce3aa16198/test/system/st_broker.conf

[Radagan]

@redboltz, Thank you. I resolved my issue with the help of these links.