@ysfscream this is more of a frontend enhancement?

Why do we even have this option? Is there a scenario when a user may want to allow plain tcp connection on SSL port?

@zmstone I don't think so, the default value of this option in the configuration file is also false.

Why do we even have this option? Is there a scenario when a user may want to allow plain tcp connection on SSL port?

Good point.

@zmstone I don't think so, the default value of this option in the configuration file is also false.

We can change default value from backend, but frontend is independent implementation.

Here is my proposal.
In 5.8, we will only expose "verify peer" option in config and in dashboard, always force client to send certificate when "verify_peer".
For backward compatibility, we will hide fail_if_no_peer_cert from backend schema.

@id When fail_if_no_peer_cert is false, the client still establishes a TLS connection to the server, it just won't be asked for a client certificate.

The only scenario I can think of is that all the user's clients access from the same TLS port, some of them provide client certificates for two-way authentication, and these clients will skip the password authentication of EMQX. The other part does not provide client certificates, after establishing a TLS connection, they must pass password authentication to actually access EMQX.

However, I think only HTTP authentication currently supports this process.

Here is my proposal. In 5.8, we will only expose "verify peer" option in config and in dashboard, always force client to send certificate when "verify_peer". For backward compatibility, we will hide fail_if_no_peer_cert from backend schema.

emmm What happens to listeners that had fail_if_no_peer_cert set to false?

Here is my proposal. In 5.8, we will only expose "verify peer" option in config and in dashboard, always force client to send certificate when "verify_peer". For backward compatibility, we will hide fail_if_no_peer_cert from backend schema.

emmm What happens to listeners that had fail_if_no_peer_cert set to false?

it will be discarded

Why do we even have this option? Is there a scenario when a user may want to allow plain tcp connection on SSL port?

Peer sending its cert is sometimes optional for TLS client (not limited to MQTT).