第7章 Mosquitto增加SSL/TLS加密通信

第7章 SSL/TLS加密通信

7.1 TLS基础

7.2 证书类型

7.3 生成自签名证书

#!/bin/bash# 生成CA私钥openssl genrsa-outca.key2048# 生成CA证书openssl req-new-x509-days3650-keyca.key-outca.crt\-subj"/CN=MQTT CA"# 生成服务器私钥openssl genrsa-outserver.key2048# 生成服务器CSRopenssl req-new-keyserver.key-outserver.csr\-subj"/CN=mosquitto-server"# CA签名服务器证书openssl x509-req-days365-inserver.csr-CAca.crt-CAkeyca.key\-CAcreateserial-outserver.crt# 生成客户端私钥openssl genrsa-outclient.key2048# 生成客户端CSRopenssl req-new-keyclient.key-outclient.csr\-subj"/CN=mqtt-client"# CA签名客户端证书openssl x509-req-days365-inclient.csr-CAca.crt-CAkeyca.key\-CAcreateserial-outclient.crtecho"证书生成完成!"

证书生成流程

7.4 Mosquitto TLS配置

单向认证(服务器)

# /etc/mosquitto/mosquitto.conf# TLS监听器listener8883certfile /etc/mosquitto/certs/server.crt keyfile /etc/mosquitto/certs/server.key cafile /etc/mosquitto/certs/ca.crt# 要求TLSallow_anonymousfalsepassword_file /etc/mosquitto/passwd

双向认证(客户端证书)

listener8883certfile /etc/mosquitto/certs/server.crt keyfile /etc/mosquitto/certs/server.key cafile /etc/mosquitto/certs/ca.crt# 要求客户端证书require_certificatetrueuse_identity_as_usernametrue# 或者使用CA验证tls_version tlsv1.2

7.5 客户端连接

mosquitto_pub/sub

# 单向认证mosquitto_sub-hbroker.example.com-p8883\--cafile/path/to/ca.crt\-t"test/#"# 双向认证mosquitto_pub-hbroker.example.com-p8883\--cafile/path/to/ca.crt\--cert/path/to/client.crt\--key/path/to/client.key\-t"test"-m"hello"# 跳过证书验证(仅测试)mosquitto_sub-hlocalhost-p8883\--insecure\-t"test/#"

Python客户端

importpaho.mqtt.clientasmqtt client=mqtt.Client()client.tls_set(ca_certs="/path/to/ca.crt",certfile="/path/to/client.crt",keyfile="/path/to/client.key",tls_version=ssl.PROTOCOL_TLSv1_2)client.connect("broker.example.com",8883)

7.6 TLS握手流程

7.7 安全检查清单

7.8 本章小结

掌握了Mosquitto的TLS配置,实现了安全的MQTT通信。