Zabbix 7.2 Agent2 MQTT Plugin issue: cannot open CA file for TLS connection

[qds013]

Hello everyone,

Debian 12 Bookworm
Zabbix 7.2.3
Agent2

I have a problem trying to setup secure MQTT connection with Agent2 MQTT plugin: Agent2 cannot find/open CA file

2025/02/05 10:29:47.029785 [101] adding new request for key: 'mqtt.get["tls://<mqtt-server>8883", "$SYS/broker/uptime", "<username>", "<password>"]'
2025/02/05 10:29:52.009903 sending [{"request":"agent data","data":[{"id":1,"itemid":48483,"state":1,"value":"open \"/etc/ssl/certs/ca_mqtt.crt\": no such file or directory","clock":1738740587,"ns":32681857}],"session":"36c21d95dbb12724687845f0a2200191","host":"zabbix-server","version":"7.2.3","variant":2}] to [127.0.0.1:10051]

/etc/zabbix/zabbix_agent2.d/plugins.d/mqtt.conf

Plugins.MQTT.Default.TLSCAFile="/etc/ssl/certs/ca_mqtt.crt"

ls -al /etc/ssl/certs/ca_mqtt.crt
-rw-r--r-- 1 root root 1464 Apr 25  2024 /etc/ssl/certs/ca_mqtt.crt zz0.yrzw6syzimrzz

In the meantime, mosquitto_sub works just fine with exactly the same CA file

mosquitto_sub -h <mqtt-server> -t '$SYS/broker/version' -p 8883 -u <username> -P <password> -C 1 --insecure  --cafile /etc/ssl/certs/ca_mqtt.crt -v
$SYS/broker/version mosquitto version 2.0.11

Any idea, please?

[cyber]

crt file is owned by root. Even if it has read permissions for "others", is there similar permissions in whole path, so others (zabbix) can get to file?
"namei -mo /etc/ssl/certs/ca_mqtt.crt" should give you all permissions along the path.

[qds013]

Yeah, I checked that - doesn't look like access permission is an issue here:

namei -mo /etc/ssl/certs/ca_mqtt.crt
f: /etc/ssl/certs/ca_mqtt.crt
drwxr-xr-x root root /
drwxr-xr-x root root etc
drwxr-xr-x root root ssl
drwxr-xr-x root root certs
-rw-r--r-- root root ca_mqtt.crt

sudo -u zabbix cat /etc/ssl/certs/ca_mqtt.crt
-----BEGIN CERTIFICATE-----
MIIECzCCAvOgAwIBAgIUSIIeRHhBycLqOP+jsRd5Ze3h5FIwDQ YJKoZIhvcNAQEL
...
​XI7wVYly8sNPCqov2ljrnImjeOB5fyef2wq7JsRtfA==
-----END CERTIFICATE-----

Can it be a problem with Agent2 itself?