无法通过Paquit的mosquitto使用X509 CA证书连接IoT中心

Question

感谢您提供的优质文档。和教程。我仍在使用mosquitto连接IoT中心。我想我将此处编写的所有选项都设置为clientId，Username，主题名称。我应该添加其他选项吗？谢谢您的帮助！

$ openssl genrsa -out rootCA.key 2048
$ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
$ # Upload rootCA.pem to IoT Hub and get verification code
$ openssl genrsa -out verificationCert.key 2048
$ openssl req -new -key verificationCert.key -out verificationCert.csr
# create csr with CN=[verification code]
$ openssl x509 -req -in verificationCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out verificationCert.pem -days 500 -sha256
$ # upload verificationCert.pem and pass verificaton
$ openssl genrsa -out deviceCert.key 2048
$ openssl req -new -key deviceCert.key -out deviceCert.csr
$ openssl x509 -req -in deviceCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out deviceCert.pem -days 500 -sha256
$ # create Device in IoT Hub
$ mosquitto_pub -d -h $myhub.azure-devices.net -p 8883 --cafile /etc/ssl/certs/Baltimore_CyberTrust_Root.pem --cert ./deviceCert.pem --key ./deviceCert.key -i $mydevice -u "$myhub.azure-devices.net/$mydevice/?api-version=2018-06-30" -t "/devices/$mydevice/messages/events/" -m '{"message": "Hello IoT Hub!"}'
Client [deviceName] sending CONNECT
Error: The connection was lost.

我也因paho而失败。https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-mqtt-support#tlsssl-configuration我的代码如下。

from paho.mqtt import client as mqtt
import ssl

path_to_root_cert = "/etc/ssl/certs/Baltimore_CyberTrust_Root.pem"
device_id = "mydevice"
iot_hub_name = "myhub"


def on_connect(client, userdata, flags, rc):
    print("Device connected with result code: " + str(rc))


def on_disconnect(client, userdata, rc):
    print("Device disconnected with result code: " + str(rc))


def on_publish(client, userdata, mid):
    print("Device sent message")


client = mqtt.Client(client_id=device_id, protocol=mqtt.MQTTv311)

client.on_connect = on_connect
client.on_disconnect = on_disconnect
client.on_publish = on_publish

# Set the username but not the password on your client
client.username_pw_set(username=iot_hub_name+".azure-devices.net/" +
                       device_id + "/?api-version=2018-06-30", password=None)

# Set the certificate and key paths on your client
cert_file = "./deviceCert.pem"
key_file = "./deviceCert.key"
client.tls_set(ca_certs=path_to_root_cert, certfile=cert_file, keyfile=key_file,
               cert_reqs=ssl.CERT_REQUIRED, tls_version=ssl.PROTOCOL_TLSv1, ciphers=None)

# Connect as before
client.connect(iot_hub_name+".azure-devices.net", port=8883)

client.publish("devices/" + device_id + "/messages/events/", "{id=123}", qos=1)
client.loop_forever()

结果跟踪，表示未经授权。

Device connected with result code: 5
Device disconnected with result code: 5

JFYI，我可以按照以下步骤使用自己的CA证书连接到AWS IoT：>

$ openssl genrsa -out rootCA.key 2048
$ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
$ openssl genrsa -out verificationCert.key 2048
$ aws iot get-registration-code  
$ openssl req -new -key verificationCert.key -out verificationCert.csr
$ openssl x509 -req -in verificationCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out verificationCert.pem -days 500 -sha256
$ # use the registration code as CN
$ aws iot register-ca-certificate --ca-certificate file://rootCA.pem --verification-cert file://verificationCert.pem  
$ aws iot update-ca-certificate --certificate-id [id which got above] --new-status ACTIVE  
$ openssl genrsa -out deviceCert.key 2048
$ openssl req -new -key deviceCert.key -out deviceCert.csr
$ openssl x509 -req -in deviceCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out deviceCert.pem -days 500 -sha256
$ aws iot register-certificate --certificate-pem file://deviceCert.pem --ca-certificate-pem file://rootCA.pem  
$ aws iot update-certificate --certificate-id [id which got above] --new-status ACTIVE  
$ mosquitto_pub -h [endpoint].iot.ap-northeast-1.amazonaws.com -p 8883 --cafile ./rootCA.pem --cert ./deviceCert.pem --key ./deviceCert.key -q 1 -d -t topic/test -i testdevice -m "Hello, World"
$ # rootCA is the CA I've got from https://www.amazontrust.com/repository/AmazonRootCA1.pem

感谢您提供的优质文档。和教程。我仍在使用mosquitto连接IoT中心。我想我将此处编写的所有选项都设置为clientId，Username，主题名称。是否有任何...

Answer 1

我可以使用与您创建各种密钥对完全相同的步骤，将mosquitto_pub连接到正确的位置。请注意，您在主题中有一个错误，它不应该以/开头（对于您的Paho样本，您做对了）。您应该检查几件事：