mosquitto ---SSL/TLS 單向認證+雙向認證
生成證書
# * Redistributions in binary form must reproduce the above copyright # notice, this list of conditions and the following disclaimer in the # documentation and/or other materials provided with the distribution. # * Neither the name of the axTLS project nor the names of its # contributors may be used to endorse or promote products derived # from this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR # A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR # CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED # TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, # DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY # OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING # NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF # THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # # # Generate the certificates and keys for testing. # PROJECT_NAME="TLS Project" # Generate the openssl configuration files. cat > ca_cert.conf << EOF [ req ] distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ] O = $PROJECT_NAME Dodgy Certificate Authority EOF cat > server_cert.conf << EOF [ req ] distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ] O = $PROJECT_NAME CN = 192.168.111.100 EOF cat > client_cert.conf << EOF [ req ] distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ] O = $PROJECT_NAME Device Certificate CN = 192.168.111.101 EOF mkdir ca mkdir server mkdir client mkdir certDER # private key generation openssl genrsa -out ca.key 1024 openssl genrsa -out server.key 1024 openssl genrsa -out client.key 1024 # cert requests openssl req -out ca.req -key ca.key -new \ -config ./ca_cert.conf openssl req -out server.req -key server.key -new \ -config ./server_cert.conf openssl req -out client.req -key client.key -new \ -config ./client_cert.conf # generate the actual certs. openssl x509 -req -in ca.req -out ca.crt \ -sha1 -days 5000 -signkey ca.key openssl x509 -req -in server.req -out server.crt \ -sha1 -CAcreateserial -days 5000 \ -CA ca.crt -CAkey ca.key openssl x509 -req -in client.req -out client.crt \ -sha1 -CAcreateserial -days 5000 \ -CA ca.crt -CAkey ca.key openssl x509 -in ca.crt -outform DER -out ca.der openssl x509 -in server.crt -outform DER -out server.der openssl x509 -in client.crt -outform DER -out client.der mv ca.crt ca.key ca/ mv server.crt server.key server/ mv client.crt client.key client/ mv ca.der server.der client.der certDER/ rm *.conf rm *.req rm *.srl
將上述程式碼儲存為makefile.sh
做如下修改，終端執行。
-
修改 CN 域中 IP 地址為你主機/裝置的 IP 地址
-
[可選]加密位數 1024 修改為你需要的加密位數
CA校驗證書測試
進行如下測試，以驗證證書是否可用：
$openssl verify -CAfile ca/ca.crt server/server.crt $openssl verify -CAfile ca/ca.crt client/client.crt
結果如下：
配置單/雙向認證
step 1.進入配置檔案
sudo vim /etc/mosquitto/mosquitto.conf
step 2.找到 Default listener,在該欄下進行如下配置
再找到Certificate based SSL/TLS support欄位.
即：
port 8883 cafile /etc/mosquitto/CA/ca.crt certfile /etc/mosquitto/CA/server/server.crt keyfile /etc/mosquitto/CA/server/server.key require_certificate true use_identity_as_username true
根據自己路徑不同配置校驗檔案路徑，這裡是把檔案放在/etc/mosquitto/CA/下
注意!!!
根據單向認證和雙向認證需要，可能需修改的欄位有：
a) port 8883 // MQTT伺服器將選擇此埠 listen
b) cafile /etc/mosquitto/CA/ca.crt
雙向認證必須配置為你的CA證書
單向認證(通常認為是client校驗server證書，下同)可選配置
單向認證中，server 和 client 端 ca 配置必須保持一致。即 server 若配置 ca.crt ,則 client 必須配置 ca.crt， server 不配置ca.crt ,client 也不可配置 ca.crt
路徑必須為絕對路徑！！！
c) certfile /etc/mosquitto/CA/server/server.crt
單項認證和雙向認證都必須配置為你的server證書
d) keyfile /etc/mosquitto/CA/server/server.key
單項認證和雙向認證都必須配置為你的server私鑰
e) require_certificate true
單向認證需設定為 false,註釋此行，預設也是 false
雙向認證必須配置為true
f) use_identity_as_username true
單向認證設定為 false,註釋此行，預設也是 false
雙向認證通常設定為true
從上面可以看出，雙向和單項認證的區別是，除了需要單向SSL認證需要的CA的證書，伺服器端的公鑰和私鑰的證書之外，還需要開啟下面的兩個開關。
require_certificate true use_identity_as_username true
重啟服務
mosquitto -c /etc/mosquitto/mosquitto.conf
如果提示埠被佔用，先ps出mosquitto，再kill掉
ps -aux | grep "mosquitto" kill -9 XXXXX
單雙向切換
單向認證只需要註釋兩行即可:
#require_certificate true #use_identity_as_username true
如下：
port 8883 cafile /etc/mosquitto/CA/ca/ca.crt certfile /etc/mosquitto/CA/server/server.crt keyfile /etc/mosquitto/CA/server/server.key
同時開啟單雙向認證
step 1.
在先將/etc/mosquitto/mosquitto.conf 檔案按上面配置預設開啟雙向認證，再找到 Extra listener欄位
進行如下配置，開啟另一個埠用作單向認證
step 2.
再在該欄位下找到Certificate based SSL/TLS support欄位
step 3.重啟服務
mosquitto -c /etc/mosquitto/mosquitto.conf
驗證
step 1.進入到CA證書目錄下：
step 2.雙向：
終端一：訂閱
mosquitto_sub -h 10.30.11.47 -p 8883 -t "mqtt/server/topic" --cafile ./ca/ca.crt --cert ./client/client.pem --key ./client/client.key &
終端二：釋出
mosquitto_pub -h 10.30.11.47 -p 8883 -t "mqtt/server/topic" -m "hello,world!" --cafile ./ca/ca.crt --cert ./server/server.pem --key ./server/server.key
step 3. 單向
終端一：訂閱
mosquitto_sub -h 10.30.11.47 -p 8884 -t "mqtt/server/topic" --cafile ./ca/ca.crt &
終端二：釋出
mosquitto_pub -h 10.30.11.47 -p 8884 -t "mqtt/server/topic" -m " hello,world!" --cafile ./ca/ca.crt