Android app与mosquitto tls单/双向认证

搭建Android app与mosquitto tls单/双向认证流程总结如下：

1. 得到的证书以及秘钥情况如下

檔案	說明
rootCA.cert.pem	ROOT CA
rt5750w.mqtt.mosquitto.chain.pem	Mosquitto Server Certificate
rt5750w.mqtt.mosquitto.key.pem	Mosquitto Server Certificate Key
rt5750w.mqtt.ca.chain.pem	Mosquitto Server CA Certificate
rt5750w.mqtt.client.chain.pem	MQTT Client Certificate
rt5750w.mqtt.client.key.pem	MQTT Client Certificate Key

2. 编辑/etc/mosquitto/mosquitto.conf文件

# Place your local configuration in /etc/mosquitto/conf.d/
#
# A full description of the configuration file is at
# /usr/share/doc/mosquitto/examples/mosquitto.conf.example

pid_file /var/run/mosquitto.pid

persistence true
persistence_location /var/lib/mosquitto/

#log_dest file /var/log/mosquitto/mosquitto.log

include_dir /etc/mosquitto/conf.d

log_dest stdout

port 8883

cafile /home/xxxx/mqtt_cert/rootCA.cert.pem

certfile /home/xxxx/mqtt_cert/rt5750w.mqtt.mosquitto.chain.pem

keyfile /home/xxxx/mqtt_cert/rt5750w.mqtt.mosquitto.key.pem

tls_version tlsv1.2

require_certificate true

use_identity_as_username true

如果去掉require_certificate true与use_identity_as_username true则为单向认证

3. 运行mosquitto -c /etc/mosquitto/mosquitto.conf -v 以启动服务器

4. 运行mosquitto_sub -h 服务器ip -p 8883 -t topic --tls-version tlsv1.2 --cafile ./rootCA.cert.pem --cert ./rt5750w.mqtt.client.chain.pem --key ./rt5750w.mqtt.client.key.pem --insecure -d (双向）

  运行mosquitto_sub -h 10.8.2.230 -p 8883 -t topic --tls-version tlsv1.2 --cafile ./rootCA.cert.pem  --insecure -d （单向）

 此步骤为了测试服务器是否成功运行

5. 转换rootCA.cert.pem为bks文件(bcprov-jdk15on-160.jar需要从网上下载)

  keytool -importcert -keystore ca.bks -file ./mqtt_cert/rootCA.cert.pem  -storetype BKS -provider org.bouncycastle.jce.provider.BouncyCastleProvider --ProviderPath ./bcprov-jdk15on-160.jar

6. 生成pcks12文件

openssl pkcs12 -export -inkey rt5750w.mqtt.client.key.pem -in rt5750w.mqtt.client.chain.pem -out client.pfx

7.参考网站http://www.zhangjunjie.net/archives/894编写Android代码 （tls版本要为1.2）