TLS connection error 49 with mosquitto

[tve]

I'm new to tasmota and am trying to set-up an esp32 using MQTT TLS (LE issued cert) and I get:

00:00:07.306 MQT: Attempting connection...
00:00:07.340 MQT: TLS connection error: 49
00:00:07.340 MQT: Connect failed to example.com:4883, rc -2. Retry in 10 sec

Where can I find what error 49 means? The docs I've seen don't show 49...

The mosquitto log shows:

1736391315: Client <unknown> disconnected: Protocol error.
1736391315: New connection from 192.168.11.96:55100 on port 4883.

Asked differently, this may be a cipher suite issue, does someone have a mosquitto listener config that works?

(I do have dozens of IoT devices that connect just fine...)

[s-hadinger]

According to BearSSL, 49 means "X.509 status: certificate contains unsupported features that cannot be ignored"

There seem to be something wrong with your cert. Can you share the domain name?

[tve]

core.voneicken.com but that's not publicly accessible.

-----BEGIN CERTIFICATE-----
MIIDhjCCAwugAwIBAgISAxvEunybL7bkZpxRzUct5Z3sMAoGCCqGSM49BAMDMDIx
CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
NjAeFw0yNTAxMDUxNTM5MTlaFw0yNTA0MDUxNTM5MThaMB0xGzAZBgNVBAMTEmNv
cmUudm9uZWlja2VuLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABKovNSah
u3Bby8hRkqN3ey2gAh7ygc2lBk/LZgBWQ5/8O+ldMm76Aam/caulJM8jaLXvAllH
fh3GLJ7ak1oCnyyjggIUMIICEDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0lBBYwFAYI
KwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFASFTge+
lj4XZrSG4jrBwOTK+t0KMB8GA1UdIwQYMBaAFJMnRpgDqVFojpjWxEJI2yO/WJTS
MFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcwAYYVaHR0cDovL2U2Lm8ubGVuY3Iu
b3JnMCIGCCsGAQUFBzAChhZodHRwOi8vZTYuaS5sZW5jci5vcmcvMB0GA1UdEQQW
MBSCEmNvcmUudm9uZWlja2VuLmNvbTATBgNVHSAEDDAKMAgGBmeBDAECATCCAQQG
CisGAQQB1nkCBAIEgfUEgfIA8AB2AHMgIg8IFor588SmiwqyappKAO71d4WKCE0F
ANSlQkRZAAABlDdUdMQAAAQDAEcwRQIgZxHOd0wVaBA5onGiWqF3o30uWS+ApoHR
3Wj39qIZPqQCIQD2GnVhF0s+uNGmBj7RzH+lCfT4n9e9WSGHKSUiciezUwB2AMz7
D2qFcQll/pWbU87psnwi6YVcDZeNtql+VMD+TA2wAAABlDdUdNYAAAQDAEcwRQIh
AIpETuROxoOE9xwfXCWTCt1o9FEtAyUJwwUcwXCsOXJTAiBiWPQlohLkkz4A0njK
9oNY3MdrsjxefrQlzccZmj8PJDAKBggqhkjOPQQDAwNpADBmAjEA2AYOJRagL7Du
vQp/vm6Z2JgCy+k4uHzF/afooF9f1WOlYJPsYYrlOv/2JeWVxsbYAjEAr3ZEJnB3
gmFqFvwdvzUA+umVYIdKkZGy7haLp9P+5QXmJM/bTV4JmDS1FXXNCIf8
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIEVzCCAj+gAwIBAgIRALBXPpFzlydw27SHyzpFKzgwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
RW5jcnlwdDELMAkGA1UEAxMCRTYwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATZ8Z5G
h/ghcWCoJuuj+rnq2h25EqfUJtlRFLFhfHWWvyILOR/VvtEKRqotPEoJhC6+QJVV
6RlAN2Z17TJOdwRJ+HB7wxjnzvdxEP6sdNgA1O1tHHMWMxCcOrLqbGL0vbijgfgw
gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSTJ0aYA6lRaI6Y1sRCSNsj
v1iU0jAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAfYt7SiA1sgWGCIpunk46r4AExIRc
MxkKgUhNlrrv1B21hOaXN/5miE+LOTbrcmU/M9yvC6MVY730GNFoL8IhJ8j8vrOL
pMY22OP6baS1k9YMrtDTlwJHoGby04ThTUeBDksS9RiuHvicZqBedQdIF65pZuhp
eDcGBcLiYasQr/EO5gxxtLyTmgsHSOVSBcFOn9lgv7LECPq9i7mfH3mpxgrRKSxH
pOoZ0KXMcB+hHuvlklHntvcI0mMMQ0mhYj6qtMFStkF1RpCG3IPdIwpVCQqu8GV7
s8ubknRzs+3C/Bm19RFOoiPpDkwvyNfvmQ14XkyqqKK5oZ8zhD32kFRQkxa8uZSu
h4aTImFxknu39waBxIRXE4jKxlAmQc4QjFZoq1KmQqQg0J/1JF8RlFvJas1VcjLv
YlvUB2t6npO6oQjB3l+PNf0DpQH7iUx3Wz5AjQCi6L25FjyE06q6BZ/QlmtYdl/8
ZYao4SRqPEs/6cAiF+Qf5zg2UkaWtDphl1LKMuTNLotvsX99HP69V2faNyegodQ0
LyTApr/vT01YPE46vNsDLgK+4cL6TrzC/a4WcmF5SRJ938zrv/duJHLXQIku5v0+
EwOy59Hdm0PT/Er/84dDV0CSjdR/2XuZM3kpysSKLgD1cKiDA+IRguODCxfO9cyY
Ig46v9mFmBvyH04=
-----END CERTIFICATE-----

[s-hadinger]

I'm not an expert in TLS certificate, but I have the impression that one the following extensions is creating some conflict:

        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier:
                04:85:4E:07:BE:96:3E:17:66:B4:86:E2:3A:C1:C0:E4:CA:FA:DD:0A
            X509v3 Authority Key Identifier:
                93:27:46:98:03:A9:51:68:8E:98:D6:C4:42:48:DB:23:BF:58:94:D2
            Authority Information Access:
                OCSP - URI:http://e6.o.lencr.org
                CA Issuers - URI:http://e6.i.lencr.org/
            X509v3 Subject Alternative Name:
                DNS:core.voneicken.com
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1

Unfortunately I don't have any working LE certificate to compare