物聯網開發筆記 (五) MQTT with SSL

為了確保 MQTT 傳輸資料的安全性，這一篇紀錄使用 openssl 自簽證書的過程

我在 Ubuntu 中使用 openssl，首先先創建資料夾 certs

$ mkdir certs

$ openssl genrsa -out certs/ca.key 4096
$ openssl req -new -x509 -days 365 -subj "/C=TW/CN=隨便填" -key certs/ca.key -out certs/ca.crt

openssl genrsa -out certs/server.key 2048
openssl req -new -key certs/server.key -subj "/C=TW/CN={Server IP 或 FQDN}" -out certs/server.csr
openssl x509 -req -CAcreateserial -days 365 -sha256 -CA certs/ca.crt -CAkey certs/ca.key -in certs/server.csr -out certs/server.crt

將 ca.crt、server.key、server.crt 移至 /mosquitto/config/certs/ 目錄下。

接著修改 conf

# SSL Port
listener 8883 
protocol mqtt
# Server Private Key
keyfile /mosquitto/config/certs/server.key 
# Server Certificate
certfile /mosquitto/config/certs/server.crt 
# CA Certificate 若不驗證 client 可以不指定 cafile
cafile /mosquitto/config/certs/ca.crt 

# WebSocket SSL Port
listener 8084 
protocol websockets
# Server Private Key
keyfile /mosquitto/config/certs/server.key 
# Server Certificate
certfile /mosquitto/config/certs/server.crt 
# CA Certificate 若不驗證 client 可以不指定 cafile
cafile /mosquitto/config/certs/ca.crt 

測試

參考資料