基于mosquitto的MQTT服務器---SSL/TLS 單向認證+雙向認證

配置單/雙向認證

1.生成證書

使用如下shell 來生成證書：

# * Redistributions in binary form must reproduce the above copyright#   notice, this list of conditions and the following disclaimer in the#   documentation and/or other materials provided with the distribution.# * Neither the name of the axTLS project nor the names of its#   contributors may be used to endorse or promote products derived#   from this software without specific prior written permission.## THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.### Generate the certificates and keys for testing.#PROJECT_NAME="TLS Project"# Generate the openssl configuration files.cat > ca_cert.conf << EOF [ req ]distinguished_name     = req_distinguished_nameprompt                 = no[ req_distinguished_name ]O                      = $PROJECT_NAME Dodgy Certificate AuthorityEOFcat > server_cert.conf << EOF [ req ]distinguished_name     = req_distinguished_nameprompt                 = no[ req_distinguished_name ]O                      = $PROJECT_NAMECN                     = 192.168.111.100EOFcat > client_cert.conf << EOF [ req ]distinguished_name     = req_distinguished_nameprompt                 = no[ req_distinguished_name ]O                      = $PROJECT_NAME Device CertificateCN                     = 192.168.111.101EOFmkdir camkdir servermkdir clientmkdir certDER# private key generationopenssl genrsa -out ca.key 1024openssl genrsa -out server.key 1024openssl genrsa -out client.key 1024# cert requestsopenssl req -out ca.req -key ca.key -new -config ./ca_cert.confopenssl req -out server.req -key server.key -new -config ./server_cert.confopenssl req -out client.req -key client.key -new -config ./client_cert.conf# generate the actual certs.openssl x509 -req -in ca.req -out ca.crt -sha1 -days 5000 -signkey ca.keyopenssl x509 -req -in server.req -out server.crt -sha1 -CAcreateserial -days 5000  -CA ca.crt -CAkey ca.keyopenssl x509 -req -in client.req -out client.crt -sha1 -CAcreateserial -days 5000  -CA ca.crt -CAkey ca.keyopenssl x509 -in ca.crt -outform DER -out ca.deropenssl x509 -in server.crt -outform DER -out server.deropenssl x509 -in client.crt -outform DER -out client.dermv ca.crt ca.key ca/mv server.crt server.key server/mv client.crt client.key client/mv ca.der server.der client.der certDER/rm *.confrm *.reqrm *.srl

將上述代碼保存為makefile.sh

做如下修改，終端執行。

• 修改 CN 域中 IP 地址為你主機/設備的 IP 地址
• [可選]加密位數 1024 修改為你需要的加密位數

2. CA校驗證書測試

進行如下測試，以驗證證書是否可用：

$openssl verify -CAfile ca/ca.crt server/server.crt$openssl verify -CAfile ca/ca.crt client/client.crt

3.配置單/雙向認證

step 1.進入配置文件

sudo vim /etc/mosquitto/mosquitto.conf

step 2.找到 Default listener,在該欄下進行如下配置,再找到Certificate based SSL/TLS support字段.

port 8883cafile /etc/mosquitto/CA/ca.crtcertfile /etc/mosquitto/CA/server/server.crtkeyfile /etc/mosquitto/CA/server/server.keyrequire_certificate trueuse_identity_as_username true

根據自己路徑不同配置校驗文件路徑，筆者是把文件放在/etc/mosquitto/CA/下

注意!!!

根據單向認證和雙向認證需要，可能需修改的字段有：

a) port 8883 // MQTT服務器將選擇此端口 listen

b) cafile /etc/mosquitto/CA/ca.crt

雙向認證必須配置為你的CA證書
單向認證(通常認為是client校驗server證書，下同)可選配置
單向認證中，server 和 client 端 ca 配置必須保持一致。即 server 若配置 ca.crt ,則 client 必須配置 ca.crt， server 不配置ca.crt ,client 也不可配置 ca.crt
路徑必須為絕對路徑！！！

c) certfile /etc/mosquitto/CA/server/server.crt
單項認證和雙向認證都必須配置為你的server證書

d) keyfile /etc/mosquitto/CA/server/server.key
單項認證和雙向認證都必須配置為你的server私鑰

e) require_certificate true
單向認證需設置為 false,注釋此行，默認也是 false

雙向認證必須配置為true

f) use_identity_as_username true
單向認證設置為 false,注釋此行，默認也是 false，注意設置為false，則需要用戶名和密碼鑒權，反之，則不需要
雙向認證通常設置為true

step 3.重啟服務

mosquitto -c /etc/mosquitto/mosquitto.conf

如果提示端口被占用，先ps出mosquitto，再kill掉
ps -aux | grep "mosquitto"
kill -9 XXXXX

4.單雙向切換

單向認證只需要注釋兩行即可:

#require_certificate true#use_identity_as_username true

如下：

port 8883
cafile  /etc/mosquitto/CA/ca/ca.crt
certfile  /etc/mosquitto/CA/server/server.crt
keyfile  /etc/mosquitto/CA/server/server.key

5.同時打開單雙向認證

step 1.
在先將/etc/mosquitto/mosquitto.conf 文件按2.4節配置默認打開雙向認證，再找到 Extra listener字段
進行如下配置，打開另一個端口用作單向認證

step 2.
再在該字段下找到Certificate based SSL/TLS support字段

step 3.重啟服務
mosquitto -c /etc/mosquitto/mosquitto.conf

如果提示端口被占用，先ps出mosquitto，再kill掉
ps -aux | grep "mosquitto"
kill -9 XXXXX

6 驗證

step 1.進入到CA證書目錄下：

step 2.雙向：
終端一：訂閱
mosquitto_sub -h 10.30.11.47 -p 8883 -t "mqtt/server/topic" --cafile ./ca/ca.crt --cert ./client/client.crt --key ./client/client.key &

終端二：發布
mosquitto_pub -h 10.30.11.47 -p 8883 -t "mqtt/server/topic" -m "hello,world!" --cafile ./ca/ca.crt --cert ./server/server.crt --key ./server/server.key

step 3. 單向
終端一：訂閱
mosquitto_sub -h 10.30.11.47 -p 8884 -t "mqtt/server/topic" --cafile ./ca/ca.crt &

終端二：發布
mosquitto_pub -h 10.30.11.47 -p 8884 -t "mqtt/server/topic" -m " hello,world!" --cafile ./ca/ca.crt