Man, this Mosquitto is just insisting on not being cool about this.
But I think now, after all your help, that I probably just don’t know what I’m doing with making the certs.
I just followed the guides (first the two I found, then the one you provided) pretty much to the letter. But that didn’t include info about altering the generate-CA.sh. And let me straight up admit, I don’t get most of that script. So it’s probably just that I didn’t do/change something that’s obvious to others?
I did change it a bit, uncommenting the IPLIST and HOSTLIST, as you also mentioned, and added a few IPs and hosts (where 192.168.0.160 is the local IP of my homeassistant/mosquitto pi, hassbian is the hostname, the duckdns is what I use to access from outside of home network.).
#!/usr/bin/env bash
#(@)generate-CA.sh - Create CA key-pair and server key-pair signed by CA
# Copyright (c) 2013-2016 Jan-Piet Mens <jpmens()gmail.com>
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#
# 1. Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
# 3. Neither the name of mosquitto nor the names of its
# contributors may be used to endorse or promote products derived from
# this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#
# Usage:
# ./generate-CA.sh creates ca.crt and server.{key,crt}
# ./generate-CA.sh hostname creates hostname.{key,crt}
# ./generate-CA.sh client email creates email.{key,crt}
#
# Set the following optional environment variables before invocation
# to add the specified IP addresses and/or hostnames to the subjAltName list
# These contain white-space-separated values
#
IPLIST="127.0.0.1 192.168.0.160"
HOSTLIST="localhost hassbian REDACTED.duckdns.org"
set -e
export LANG=C
kind=server
if [ $# -ne 2 ]; then
kind=server
host=$(hostname -f)
if [ -n "$1" ]; then
host="$1"
fi
else
kind=client
CLIENT="$2"
fi
[ -z "$USER" ] && USER=root
DIR=${TARGET:='.'}
# A space-separated list of alternate hostnames (subjAltName)
# may be empty ""
ALTHOSTNAMES=${HOSTLIST}
ALTADDRESSES=${IPLIST}
CA_ORG='/O=OwnTracks.org/OU=generate-CA/[email protected]'
CA_DN="/CN=An MQTT broker${CA_ORG}"
CACERT=${DIR}/ca
SERVER="${DIR}/${host}"
SERVER_DN="/CN=${host}$CA_ORG"
keybits=2048
openssl=$(which openssl)
MOSQUITTOUSER=${MOSQUITTOUSER:=$USER}
# Signature Algorithm. To find out which are supported by your
# version of OpenSSL, run `openssl dgst -help` and set your
# signature algorithm here. For example:
#
# defaultmd="-sha256"
#
defaultmd="-sha512"
function maxdays() {
nowyear=$(date +%Y)
years=$(expr 2032 - $nowyear)
days=$(expr $years '*' 365)
echo $days
}
function getipaddresses() {
/sbin/ifconfig |
grep -v tunnel |
sed -En '/inet6? /p' |
sed -Ee 's/inet6? (addr:)?//' |
awk '{print $1;}' |
sed -e 's/[%/].*//' |
egrep -v '(::1|127\.0\.0\.1)' # omit loopback to add it later
}
function addresslist() {
ALIST=""
for a in $(getipaddresses); do
ALIST="${ALIST}IP:$a,"
done
ALIST="${ALIST}IP:127.0.0.1,IP:::1,"
for ip in $(echo ${ALTADDRESSES}); do
ALIST="${ALIST}IP:${ip},"
done
for h in $(echo ${ALTHOSTNAMES}); do
ALIST="${ALIST}DNS:$h,"
done
ALIST="${ALIST}DNS:localhost"
echo $ALIST
}
days=$(maxdays)
if [ -n "$CAKILLFILES" ]; then
rm -f $CACERT.??? $SERVER.??? $CACERT.srl
fi
if [ ! -f $CACERT.crt ]; then
# ____ _
# / ___| / \
# | | / _ \
# | |___ / ___ \
# \____/_/ \_\
#
# Create un-encrypted (!) key
$openssl req -newkey rsa:${keybits} -x509 -nodes $defaultmd -days $days -extensions v3_ca -keyout $CA$
echo "Created CA certificate in $CACERT.crt"
$openssl x509 -in $CACERT.crt -nameopt multiline -subject -noout
chmod 400 $CACERT.key
chmod 444 $CACERT.crt
chown $MOSQUITTOUSER $CACERT.*
echo "Warning: the CA key is not encrypted; store it safely!"
fi
if [ $kind == 'server' ]; then
# ____
# / ___| ___ _ ____ _____ _ __
# \___ \ / _ \ '__\ \ / / _ \ '__|
# ___) | __/ | \ V / __/ |
# |____/ \___|_| \_/ \___|_|
#
if [ ! -f $SERVER.key ]; then
echo "--- Creating server key and signing request"
$openssl genrsa -out $SERVER.key $keybits
$openssl req -new $defaultmd \
-out $SERVER.csr \
-key $SERVER.key \
-subj "${SERVER_DN}"
chmod 400 $SERVER.key
chown $MOSQUITTOUSER $SERVER.key
fi
if [ -f $SERVER.csr -a ! -f $SERVER.crt ]; then
# There's no way to pass subjAltName on the CLI so
# create a cnf file and use that.
CNF=`mktemp /tmp/cacnf.XXXXXXXX` || { echo "$0: can't create temp file" >&2; exit 1; }
sed -e 's/^.*%%% //' > $CNF <<\!ENDconfig
%%% [ JPMextensions ]
%%% basicConstraints = critical,CA:false
%%% nsCertType = server
%%% keyUsage = nonRepudiation, digitalSignature, keyEncipherment
%%% nsComment = "Broker Certificate"
%%% subjectKeyIdentifier = hash
%%% authorityKeyIdentifier = keyid,issuer:always
%%% subjectAltName = $ENV::SUBJALTNAME
%%% # issuerAltName = issuer:copy
%%% ## nsCaRevocationUrl = http://mqttitude.org/carev/
%%% ## nsRevocationUrl = http://mqttitude.org/carev/
%%% certificatePolicies = ia5org,@polsection
%%%
%%% [polsection]
%%% policyIdentifier = 1.3.5.8
%%% CPS.1 = "http://localhost"
%%% userNotice.1 = @notice
%%%
%%% [notice]
%%% explicitText = "This CA is for a local MQTT broker installation only"
%%% organization = "OwnTracks"
%%% noticeNumbers = 1
!ENDconfig
SUBJALTNAME="$(addresslist)"
export SUBJALTNAME # Use environment. Because I can. ;-)
echo "--- Creating and signing server certificate"
$openssl x509 -req $defaultmd \
-in $SERVER.csr \
-CA $CACERT.crt \
-CAkey $CACERT.key \
-CAcreateserial \
-CAserial "${DIR}/ca.srl" \
-out $SERVER.crt \
-days $days \
-extfile ${CNF} \
-extensions JPMextensions
rm -f $CNF
chmod 444 $SERVER.crt
chown $MOSQUITTOUSER $SERVER.crt
fi
else
# ____ _ _ _
# / ___| (_) ___ _ __ | |_
# | | | | |/ _ \ '_ \| __|
# | |___| | | __/ | | | |_
# \____|_|_|\___|_| |_|\__|
#
if [ ! -f $CLIENT.key ]; then
echo "--- Creating client key and signing request"
$openssl genrsa -out $CLIENT.key $keybits
CNF=`mktemp /tmp/cacnf-req.XXXXXXXX` || { echo "$0: can't create temp file" >&2; exit 1; }
# Mosquitto's use_identity_as_username takes the CN attribute
# so we're populating that with the client's name
sed -e 's/^.*%%% //' > $CNF <<!ENDClientconfigREQ
%%% [ req ]
%%% distinguished_name = req_distinguished_name
%%% prompt = no
%%% output_password = secret
%%%
%%% [ req_distinguished_name ]
%%% # O = OwnTracks
%%% # OU = MQTT
%%% # CN = Suzie Smith
%%% CN = $CLIENT
%%% # emailAddress = $CLIENT
!ENDClientconfigREQ
$openssl req -new $defaultmd \
-out $CLIENT.csr \
-key $CLIENT.key \
-config $CNF
chmod 400 $CLIENT.key
fi
if [ -f $CLIENT.csr -a ! -f $CLIENT.crt ]; then
CNF=`mktemp /tmp/cacnf-cli.XXXXXXXX` || { echo "$0: can't create temp file" >&2; exit 1; }
sed -e 's/^.*%%% //' > $CNF <<\!ENDClientconfig
%%% [ JPMclientextensions ]
%%% basicConstraints = critical,CA:false
%%% subjectAltName = email:copy
%%% nsCertType = client,email
%%% extendedKeyUsage = clientAuth,emailProtection
%%% keyUsage = digitalSignature, keyEncipherment, keyAgreement
%%% nsComment = "Client Broker Certificate"
%%% subjectKeyIdentifier = hash
%%% authorityKeyIdentifier = keyid,issuer:always
!ENDClientconfig
SUBJALTNAME="$(addresslist)"
export SUBJALTNAME # Use environment. Because I can. ;-)
echo "--- Creating and signing client certificate"
$openssl x509 -req $defaultmd \
-in $CLIENT.csr \
-CA $CACERT.crt \
-CAkey $CACERT.key \
-CAcreateserial \
-CAserial "${DIR}/ca.srl" \
-out $CLIENT.crt \
-days $days \
-extfile ${CNF} \
-extensions JPMclientextensions
rm -f $CNF
chmod 444 $CLIENT.crt
fi
fi
Is there anything else I should have altered?
I can get
mosquitto_sub -t "owntracks/#" -u aephir -P MosquittoPie -d --cafile /etc/mosquitto/ca_certificates/ca.crt -p 8883
to work, with
mosquitto_pub -t "owntracks/test" -u aephir -P MosquittoPie -d --cafile /etc/mosquitto/ca_certificates/ca.crt -p 8883 -m "Hello"
With this, when I have my /etc/mosquitto/mosquitto.conf as:
# Place your local configuration in /etc/mosquitto/conf.d/
#
# A full description of the configuration file is at
# /usr/share/doc/mosquitto/examples/mosquitto.conf.example
pid_file /var/run/mosquitto.pid
persistence true
persistence_location /var/lib/mosquitto/
log_dest file /var/log/mosquitto/mosquitto.log
include_dir /etc/mosquitto/conf.d
log_type error
log_type warning
log_type notice
log_type information
#topic owntracks/
connection_messages true
log_timestamp true
allow_anonymous false
password_file /etc/mosquitto/passwd
persistence_file mosquitto.db
and my /etc/mosquitto/conf.d/mosquitto.conf as
#
# A full description of the configuration file is at
# /usr/share/doc/mosquitto/examples/mosquitto.conf.example
# Plain MQTT protocol
listener 1883
log_dest syslog
log_dest stdout
log_dest topic
log_type error
log_type warning
log_type notice
log_type information
connection_messages true
log_timestamp true
# End of plain MQTT configuration
# MQTT over TLS/SSL
listener 8883
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/hassbian.crt
keyfile /etc/mosquitto/certs/hassbian.key
log_type error
log_type warning
log_type notice
log_type information
#tls_Version tls1.2
# End of MQTT over TLS/SLL configuration
But this, of course, doesn’t have the “require cert” that you have in your conf, and when I add that, it fails.
Here’s keeping my fingers crossed that it’s just some stupid thing in the generate-CA.sh script I didn’t know to change.
EDIT: If this matters, as soon as I un-comment tls_Version tls1.2 to the config, I get an Error: Connection refused when trying use the mosquitto_sub I listed above
