mosquitto ---SSL/TLS 單向認證+雙向認證

生成證書

# * Redistributions in binary form must reproduce the above copyright
 
#   notice, this list of conditions and the following disclaimer in the
 
#   documentation and/or other materials provided with the distribution.
 
# * Neither the name of the axTLS project nor the names of its
 
#   contributors may be used to endorse or promote products derived
 
#   from this software without specific prior written permission.
 
#
 
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
 
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
 
# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 
# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 
# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
#
 
 
 
#
 
# Generate the certificates and keys for testing.
 
#
 
 
 
 
 
PROJECT_NAME="TLS Project"
 
 
 
# Generate the openssl configuration files.
 
cat > ca_cert.conf << EOF 
 
[ req ]
 
distinguished_name     = req_distinguished_name
 
prompt                 = no
 
 
 
[ req_distinguished_name ]
 
 O                      = $PROJECT_NAME Dodgy Certificate Authority
 
EOF
 
 
 
cat > server_cert.conf << EOF 
 
[ req ]
 
distinguished_name     = req_distinguished_name
 
prompt                 = no
 
 
 
[ req_distinguished_name ]
 
 O                      = $PROJECT_NAME
 
 CN                     = 192.168.111.100
 
EOF
 
 
 
cat > client_cert.conf << EOF 
 
[ req ]
 
distinguished_name     = req_distinguished_name
 
prompt                 = no
 
 
 
[ req_distinguished_name ]
 
 O                      = $PROJECT_NAME Device Certificate
 
 CN                     = 192.168.111.101
 
EOF
 
 
 
mkdir ca
 
mkdir server
 
mkdir client
 
mkdir certDER
 
 
 
# private key generation
 
openssl genrsa -out ca.key 1024
 
openssl genrsa -out server.key 1024
 
openssl genrsa -out client.key 1024
 
 
 
# cert requests
 
openssl req -out ca.req -key ca.key -new \
 
            -config ./ca_cert.conf
 
openssl req -out server.req -key server.key -new \
 
            -config ./server_cert.conf
 
openssl req -out client.req -key client.key -new \
 
            -config ./client_cert.conf
 
 
 
# generate the actual certs.
 
openssl x509 -req -in ca.req -out ca.crt \
 
            -sha1 -days 5000 -signkey ca.key
 
openssl x509 -req -in server.req -out server.crt \
 
            -sha1 -CAcreateserial -days 5000 \
 
            -CA ca.crt -CAkey ca.key
 
openssl x509 -req -in client.req -out client.crt \
 
            -sha1 -CAcreateserial -days 5000 \
 
            -CA ca.crt -CAkey ca.key
 
 
 
openssl x509 -in ca.crt -outform DER -out ca.der
 
openssl x509 -in server.crt -outform DER -out server.der
 
openssl x509 -in client.crt -outform DER -out client.der
 
 
 
mv ca.crt ca.key ca/
 
mv server.crt server.key server/
 
mv client.crt client.key client/
 
 
 
mv ca.der server.der client.der certDER/
 
 
 
rm *.conf
 
rm *.req
 
rm *.srl

　　

將上述代碼保存爲makefile.sh

作以下修改，終端執行。

• 修改 CN 域中 IP 地址爲你主機/設備的 IP 地址

•  

   [可選]加密位數 1024 修改成你須要的加密位數

CA校驗證書測試

進行以下測試，以驗證證書是否可用：

$openssl verify -CAfile ca/ca.crt server/server.crt

$openssl verify -CAfile ca/ca.crt client/client.crt

結果以下：

 

配置單/雙向認證

step 1.進入配置文件

sudo vim /etc/mosquitto/mosquitto.conf

 

step 2.找到 Default listener,在該欄下進行以下配置

 

再找到Certificate based SSL/TLS support字段. 

即：

port 8883

cafile /etc/mosquitto/CA/ca.crt

certfile /etc/mosquitto/CA/server/server.crt

keyfile /etc/mosquitto/CA/server/server.key

require_certificate true

use_identity_as_username true

　　

根據本身路徑不一樣配置校驗文件路徑，這裏是把文件放在/etc/mosquitto/CA/下

注意!!!

根據單向認證和雙向認證須要，可能需修改的字段有：

a) port 8883 // MQTT服務器將選擇此端口 listen

b) cafile /etc/mosquitto/CA/ca.crt

雙向認證必須配置爲你的CA證書

單向認證(一般認爲是client校驗server證書，下同)可選配置

單向認證中，server 和 client 端 ca 配置必須保持一致。即 server 若配置 ca.crt ,則 client 必須配置 ca.crt， server 不配置ca.crt ,client 也不可配置 ca.crt

路徑必須爲絕對路徑！！！

 

c) certfile /etc/mosquitto/CA/server/server.crt

單項認證和雙向認證都必須配置爲你的server證書

 

d) keyfile /etc/mosquitto/CA/server/server.key

單項認證和雙向認證都必須配置爲你的server私鑰

 

e) require_certificate true

單向認證需設置爲 false,註釋此行，默認也是 false

雙向認證必須配置爲true

 

f) use_identity_as_username true

單向認證設置爲 false,註釋此行，默認也是 false

雙向認證一般設置爲true

從上面能夠看出，雙向和單項認證的區別是，除了須要單向SSL認證須要的CA的證書，服務器端的公鑰和私鑰的證書以外，還須要開啓下面的兩個開關。

 

require_certificate true

use_identity_as_username true

 

　　

　

重啓服務

mosquitto -c /etc/mosquitto/mosquitto.conf

若是提示端口被佔用，先ps出mosquitto，再kill掉

ps -aux | grep "mosquitto"

kill -9 XXXXX

單雙向切換

單向認證只須要註釋兩行便可:

#require_certificate true

#use_identity_as_username true

以下：

port 8883

cafile  /etc/mosquitto/CA/ca/ca.crt

certfile  /etc/mosquitto/CA/server/server.crt

keyfile  /etc/mosquitto/CA/server/server.key

 

同時打開單雙向認證

step 1.

在先將/etc/mosquitto/mosquitto.conf 文件按上面配置默認打開雙向認證，再找到 Extra listener字段

進行以下配置，打開另外一個端口用做單向認證

step 2.

再在該字段下找到Certificate based SSL/TLS support字段

　

step 3.重啓服務

mosquitto -c /etc/mosquitto/mosquitto.conf

 

驗證

step 1.進入到CA證書目錄下：

step 2.雙向：

終端一：訂閱

mosquitto_sub -h 10.30.11.47  -p 8883 -t "mqtt/server/topic" --cafile ./ca/ca.crt --cert ./client/client.pem --key ./client/client.key &

 

終端二：發佈

mosquitto_pub -h 10.30.11.47  -p 8883 -t "mqtt/server/topic" -m "hello,world!" --cafile ./ca/ca.crt --cert ./server/server.pem --key ./server/server.key

　　

step 3. 單向

終端一：訂閱

mosquitto_sub -h 10.30.11.47  -p 8884 -t "mqtt/server/topic" --cafile ./ca/ca.crt &

　　

終端二：發佈

mosquitto_pub -h 10.30.11.47  -p 8884 -t "mqtt/server/topic" -m " hello,world!" --cafile ./ca/ca.crt