Mosquitto

p:: MQTT f:: Homebrew

brew install mosquitto

Mosquitto SSL Configuration -MQTT TLS Security
- mosquitto-tls — Configure SSL/TLS support for Mosquitto

Overview of Steps

Create a CA key pair
Create CA certificate and use the CA key from step 1 to sign it.
Create a broker key pair don’t password protect.
Create a broker certificate request using key from step 3
Use the CA certificate to sign the broker certificate request from step 4.
Now we should have a CA key file,a CA certificate file, a broker key file, and a broker certificate file.
Place all files in a directory on the broker e.g. certs
Copy the CA certificate file to the client.
Edit the Mosquitto conf file to use the files -details below
Edit the client script to use TLS and the CA certificate. -details below

sudo su

1. Create a CA key pair

Note: it is OK to create a password protected key for the CA.

openssl genrsa -des3 -out ca.key 2048

Generating RSA private key, 2048 bit long modulus (2 primes)
...............+++++
....................+++++
e is 65537 (0x010001)
Enter pass phrase for ca.key:
Verifying - Enter pass phrase for ca.key:

cat ca.key

2. Create CA certificate and use the CA key from step 1 to sign it

openssl req -new -x509 -days 36500 -key ca.key -out ca.crt

Enter pass phrase for ca.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:IN
State or Province Name (full name) [Some-State]:TamilNadu
Locality Name (eg, city) []:Chennai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:

cat ca.crt

3. Create a broker key pair. don’t password protect

openssl genrsa -out server.key 2048

Generating RSA private key, 2048 bit long modulus (2 primes)
...+++++
..................................................................................................+++++
e is 65537 (0x010001)

cat server.key

4. Create a broker certificate request using key from step 3

When filling out the form the Common Name is important and is usually the domain name of the server. You could use the IP address or Full domain name. You must use the same name when configuring the client connection.

openssl req -new -out server.csr -key server.key

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:IN
State or Province Name (full name) [Some-State]:TamilNadu
Locality Name (eg, city) []:Chennai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
 
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

cat server.csr

5. Use the CA certificate to sign the broker certificate request from step 4

openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 36500

Signature ok
subject=C = IN, ST = TamilNadu, L = Chennai, O = , OU = , CN = , emailAddress =
Getting CA Private Key
Enter pass phrase for ca.key:

cat server.crt

6. Copy files to mosquitto folder

cp ca.crt /etc/mosquitto/ca_certificates/
 
cp server.crt /etc/mosquitto/certs/
cp server.key /etc/mosquitto/certs/

8. Copy the CA certificate file to the client

# scp ca.crt ...

9. Edit the `mosquitto.conf` file

vim /etc/mosquitto/mosquitto.conf

# Place your local configuration in /etc/mosquitto/conf.d/
#
# A full description of the configuration file is at
# /usr/share/doc/mosquitto/examples/mosquitto.conf.example

pid_file /var/run/mosquitto.pid

persistence true
persistence_location /var/lib/mosquitto/

log_dest file /var/log/mosquitto/mosquitto.log

include_dir /etc/mosquitto/conf.d


port 8883

cafile /root/ca.crt
keyfile /root/server.key
certfile /root/server.crt

service mosquitto restart

Verify

apt update && apt install mosquitto mosquitto-clients -y

mosquitto_sub -h b1 \
  -p 8883 \
  --cafile ca.crt \
  -t '#' \
  -v

mosquitto_pub -h b1 \
  -p 8883 \
  --cafile ca.crt \
  -t test \
  -m Hello

🪴 Adithya Jayasankar

Explorer

Mosquitto

Overview of Steps

1. Create a CA key pair

2. Create CA certificate and use the CA key from step 1 to sign it

3. Create a broker key pair. don’t password protect

4. Create a broker certificate request using key from step 3

5. Use the CA certificate to sign the broker certificate request from step 4

6. Copy files to mosquitto folder

8. Copy the CA certificate file to the client

9. Edit the `mosquitto.conf` file

Verify

Graph View

Table of Contents

Backlinks

🪴 Adithya Jayasankar

Explorer

Mosquitto

Overview of Steps

1. Create a CA key pair

2. Create CA certificate and use the CA key from step 1 to sign it

3. Create a broker key pair. don’t password protect

4. Create a broker certificate request using key from step 3

5. Use the CA certificate to sign the broker certificate request from step 4

6. Copy files to mosquitto folder

8. Copy the CA certificate file to the client

9. Edit the mosquitto.conf file

Verify

Graph View

Table of Contents

Backlinks

9. Edit the `mosquitto.conf` file