第7章 SSL/TLS加密通信7.1 TLS基础未加密明文传输可被窃听TLS加密加密传输身份验证数据完整性7.2 证书类型X.509证书CA证书服务器证书客户端证书根证书中间证书单域名通配符SAN多域名双向认证7.3 生成自签名证书#!/bin/bash# 生成CA私钥openssl genrsa-outca.key2048# 生成CA证书openssl req-new-x509-days3650-keyca.key-outca.crt\-subj/CNMQTT CA# 生成服务器私钥openssl genrsa-outserver.key2048# 生成服务器CSRopenssl req-new-keyserver.key-outserver.csr\-subj/CNmosquitto-server# CA签名服务器证书openssl x509-req-days365-inserver.csr-CAca.crt-CAkeyca.key\-CAcreateserial-outserver.crt# 生成客户端私钥openssl genrsa-outclient.key2048# 生成客户端CSRopenssl req-new-keyclient.key-outclient.csr\-subj/CNmqtt-client# CA签名客户端证书openssl x509-req-days365-inclient.csr-CAca.crt-CAkeyca.key\-CAcreateserial-outclient.crtecho证书生成完成!证书生成流程开始生成CA密钥生成CA证书生成服务器密钥生成服务器CSRCA签名服务器证书生成客户端密钥生成客户端CSRCA签名客户端证书完成7.4 Mosquitto TLS配置单向认证(服务器)# /etc/mosquitto/mosquitto.conf# TLS监听器listener8883certfile /etc/mosquitto/certs/server.crt keyfile /etc/mosquitto/certs/server.key cafile /etc/mosquitto/certs/ca.crt# 要求TLSallow_anonymousfalsepassword_file /etc/mosquitto/passwd双向认证(客户端证书)listener8883certfile /etc/mosquitto/certs/server.crt keyfile /etc/mosquitto/certs/server.key cafile /etc/mosquitto/certs/ca.crt# 要求客户端证书require_certificatetrueuse_identity_as_usernametrue# 或者使用CA验证tls_version tlsv1.27.5 客户端连接mosquitto_pub/sub# 单向认证mosquitto_sub-hbroker.example.com-p8883\--cafile/path/to/ca.crt\-ttest/## 双向认证mosquitto_pub-hbroker.example.com-p8883\--cafile/path/to/ca.crt\--cert/path/to/client.crt\--key/path/to/client.key\-ttest-mhello# 跳过证书验证(仅测试)mosquitto_sub-hlocalhost-p8883\--insecure\-ttest/#Python客户端importpaho.mqtt.clientasmqtt clientmqtt.Client()client.tls_set(ca_certs/path/to/ca.crt,certfile/path/to/client.crt,keyfile/path/to/client.key,tls_versionssl.PROTOCOL_TLSv1_2)client.connect(broker.example.com,8883)7.6 TLS握手流程服务器客户端服务器客户端TLS握手完成开始加密通信ClientHello(支持的加密套件)ServerHello(选择的加密套件) 服务器证书CertificateRequest(双向认证)验证服务器证书客户端证书(如果请求)ClientKeyExchange(预主密钥)CertificateVerify(签名验证)ChangeCipherSpecFinishedChangeCipherSpecFinished7.7 安全检查清单TLS安全检查证书有效性加密套件协议版本密钥长度未过期受信任CA禁用弱算法优先ECDHETLS 1.2禁用SSLv3RSA 2048ECDSA 2567.8 本章小结掌握了Mosquitto的TLS配置,实现了安全的MQTT通信。