Make sure we trust internal cdn CA

global/overlay/etc/puppet/modules/cdn/manifests/mqtt.pp

@@ -9,6 +9,7 @@ class cdn::mqtt(
 )
 {
   include sunet::packages::certbot
+  include cdn::ca_trust
 
   package {'mosquitto': ensure => installed }
 

global/overlay/etc/puppet/modules/cdn/templates/mqtt/cdn.conf.erb

@@ -1,7 +1,7 @@
 listener 8883
-cafile /etc/mosquitto/ca_certificates/ca.crt
+cafile /etc/mosquitto/ca_certificates/chain.pem
-certfile /etc/mosquitto/certs/<%= @networking['fqdn'] %>.crt
+certfile /etc/mosquitto/certs/cert.pem
-keyfile /etc/mosquitto/certs/<%= @networking['fqdn'] %>.key
+keyfile /etc/mosquitto/certs/privkey.pem
 require_certificate true
 use_identity_as_username true
 acl_file /etc/mosquitto/aclfile
@@ -12,8 +12,8 @@ log_type all
 connection <%= @dc %>-to-<%= remote_dc %>
 address <%= bridge_config['address'] %>:address <%= bridge_config['port'] %>:
 topic cdn/<%= @dc %>/purge out 1
-bridge_cafile /etc/mosquitto/ca_certificates/ca.crt
+bridge_cafile /usr/local/share/ca-certificates/step_ca_root.crt
-bridge_certfile /etc/mosquitto/certs/<%= @networking['fqdn'] %>.crt
+bridge_certfile /etc/mosquitto/certs/cert.pem
-bridge_keyfile /etc/mosquitto/certs/<%= @networking['fqdn'] %>.key
+bridge_keyfile /etc/mosquitto/certs/privkey.pem
 
 <% end -%>