无法使用 mosquitto、paho 的 X509 CA 证书连接 IoT 中心

Question

感谢您提供出色的文档。和教程。 我仍然在使用 mosquitto 连接 IoT Hub。我想我将这里写的所有选项设置为 clientId、用户名、主题名称。我应该添加任何其他选项吗？感谢您的帮助！

$ openssl genrsa -out rootCA.key 2048
$ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
$ # Upload rootCA.pem to IoT Hub and get verification code
$ openssl genrsa -out verificationCert.key 2048
$ openssl req -new -key verificationCert.key -out verificationCert.csr
# create csr with CN=[verification code]
$ openssl x509 -req -in verificationCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out verificationCert.pem -days 500 -sha256
$ # upload verificationCert.pem and pass verificaton
$ openssl genrsa -out deviceCert.key 2048
$ openssl req -new -key deviceCert.key -out deviceCert.csr
$ openssl x509 -req -in deviceCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out deviceCert.pem -days 500 -sha256
$ # create Device in IoT Hub
$ mosquitto_pub -d -h $myhub.azure-devices.net -p 8883 --cafile /etc/ssl/certs/Baltimore_CyberTrust_Root.pem --cert ./deviceCert.pem --key ./deviceCert.key -i $mydevice -u "$myhub.azure-devices.net/$mydevice/?api-version=2018-06-30" -t "/devices/$mydevice/messages/events/" -m '{"message": "Hello IoT Hub!"}'
Client [deviceName] sending CONNECT
Error: The connection was lost.

我也被 paho 失败了。 https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-mqtt-support#tlsssl-configuration 我的代码如下。

from paho.mqtt import client as mqtt
import ssl

path_to_root_cert = "/etc/ssl/certs/Baltimore_CyberTrust_Root.pem"
device_id = "mydevice"
iot_hub_name = "myhub"


def on_connect(client, userdata, flags, rc):
    print("Device connected with result code: " + str(rc))


def on_disconnect(client, userdata, rc):
    print("Device disconnected with result code: " + str(rc))


def on_publish(client, userdata, mid):
    print("Device sent message")


client = mqtt.Client(client_id=device_id, protocol=mqtt.MQTTv311)

client.on_connect = on_connect
client.on_disconnect = on_disconnect
client.on_publish = on_publish

# Set the username but not the password on your client
client.username_pw_set(username=iot_hub_name+".azure-devices.net/" +
                       device_id + "/?api-version=2018-06-30", password=None)

# Set the certificate and key paths on your client
cert_file = "./deviceCert.pem"
key_file = "./deviceCert.key"
client.tls_set(ca_certs=path_to_root_cert, certfile=cert_file, keyfile=key_file,
               cert_reqs=ssl.CERT_REQUIRED, tls_version=ssl.PROTOCOL_TLSv1, ciphers=None)

# Connect as before
client.connect(iot_hub_name+".azure-devices.net", port=8883)

client.publish("devices/" + device_id + "/messages/events/", "{id=123}", qos=1)
client.loop_forever()

结果如下，表示未经授权。

Device connected with result code: 5
Device disconnected with result code: 5

JFYI，我可以按照以下步骤使用自己的 CA 证书连接到 AWS IoT

$ openssl genrsa -out rootCA.key 2048
$ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
$ openssl genrsa -out verificationCert.key 2048
$ aws iot get-registration-code  
$ openssl req -new -key verificationCert.key -out verificationCert.csr
$ openssl x509 -req -in verificationCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out verificationCert.pem -days 500 -sha256
$ # use the registration code as CN
$ aws iot register-ca-certificate --ca-certificate file://rootCA.pem --verification-cert file://verificationCert.pem  
$ aws iot update-ca-certificate --certificate-id [id which got above] --new-status ACTIVE  
$ openssl genrsa -out deviceCert.key 2048
$ openssl req -new -key deviceCert.key -out deviceCert.csr
$ openssl x509 -req -in deviceCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out deviceCert.pem -days 500 -sha256
$ aws iot register-certificate --certificate-pem file://deviceCert.pem --ca-certificate-pem file://rootCA.pem  
$ aws iot update-certificate --certificate-id [id which got above] --new-status ACTIVE  
$ mosquitto_pub -h [endpoint].iot.ap-northeast-1.amazonaws.com -p 8883 --cafile ./rootCA.pem --cert ./deviceCert.pem --key ./deviceCert.key -q 1 -d -t topic/test -i testdevice -m "Hello, World"
$ # rootCA is the CA I've got from https://www.amazontrust.com/repository/AmazonRootCA1.pem

Answer 1

我可以很好地与mosquitto_pub 连接，使用与您创建各种密钥对完全相同的步骤。请注意，您在该主题中有一个错误，它不应该以 / 开头（对于您的 Paho 示例，您做对了）。 您应该检查的几件事：

• 您能否确认您在 IoT 中心将您的设备配置为 X.509 CA 签名，而不是“自签名”？
• 您的设备证书的 CN 不应包含特殊字符或空格，并且您应使用与设备 ID 完全相同的名称（您的 $mydevice 变量）在您的 IoT 中创建“X.509 CA 签名”设备集线器。