• bash腳本，生成自簽名ca、服務(wù)端、客戶(hù)端的key和證書(shū)

• #/bin/sh
  rm -f ca.*
  rm -f emqx.*
  rm -f client.*
  # 生成自簽名的CA key和證書(shū)
  openssl genrsa -out ca.key 2048
  openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.pem -subj "/C=CN/ST=Jiangsu/L=Suzhou/O=XXX/CN=SelfCA"
  #openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.pem
   
  # 生成服務(wù)器端的key和證書(shū)
  openssl genrsa -out emqx.key 2048
  openssl req -new -key ./emqx.key -config openssl.cnf -out emqx.csr
  openssl x509 -req -in ./emqx.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out emqx.pem -days 3650 -sha256 -extensions v3_req -extfile openssl.cnf
   
   
  # 生成客戶(hù)端key和證書(shū)
  openssl genrsa -out client.key 2048
  openssl req -new -key client.key -out client.csr -subj "/C=CN/ST=Jiangsu/L=Suzhou/O=XXX/CN=client"
  openssl x509 -req -days 3650 -in client.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out client.pem
   
   

  openssl.cnf配置文件

• [req]
  default_bits  = 2048
  distinguished_name = req_distinguished_name
  req_extensions = req_ext
  x509_extensions = v3_req
  prompt = no
  [req_distinguished_name]
  countryName = CN
  stateOrProvinceName = Jiangsu
  localityName = Suzhou
  organizationName = XXX
  commonName = Emqx
  [req_ext]
  subjectAltName = @alt_names
  [v3_req]
  subjectAltName = @alt_names
  [alt_names]
  IP.1 = 192.168.60.135
  IP.2 = 127.0.0.1
  #DNS.1 = BROKER_ADDRESS
   

  驗(yàn)證證書(shū)是否有效

• openssl verify -CAfile ca.pem emqx.pem
  openssl verify -CAfile ca.pem client.pem

  將證書(shū)文件拷貝到emqx\etc\certs目錄下（默認(rèn)目錄），并修改配置文件emqx.conf。SSL/TLS 雙向連接的啟用及驗(yàn)證

• ## NOTE:
  ## This config file overrides data/configs/cluster.hocon,
  ## and is merged with environment variables which start with 'EMQX_' prefix.
  ##
  ## Config changes made from EMQX dashboard UI, management HTTP API, or CLI
  ## are stored in data/configs/cluster.hocon.
  ## To avoid confusion, please do not store the same configs in both files.
  ##
  ## See https://www.emqx.io/docs/en/v5.0/configuration/configuration.html for more details.
  ## Configuration full example can be found in etc/examples
  
  node {
    name = "emqx@127.0.0.1"
    cookie = "emqxsecretcookie"
    data_dir = "data"
  }
  
  cluster {
    name = emqxcl
    discovery_strategy = manual
  }
  
  dashboard {
      listeners.http {
          bind = 18083
      }
  }
  
  listeners.ssl.default {
     bind = "0.0.0.0:8883"
     ssl_options {
       cacertfile = "/opt/emqx/etc/certs/ca.pem"
  
       certfile = "/opt/emqx/etc/certs/server.pem"
       keyfile = "/opt/emqx/etc/certs/server.key"
       # 私鑰文件受密碼保護(hù)時(shí)需要輸入密碼
       #password = "123456"
  
       # 單向認(rèn)證，不驗(yàn)證客戶(hù)端證書(shū)
       #verify = verify_none
        verify = verify_peer
        fail_if_no_peer_cert = true
     }
   }
  

  mqttx連接驗(yàn)證

• 

出現(xiàn)連接成功，代表測(cè)試無(wú)問(wèn)題

?文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-838537.html

到了這里，關(guān)于emqx 配置ssl/tls 雙向認(rèn)證（親自測(cè)試有效）的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！