吐槽

写正文之前，先感慨一下如何给自己挖了一个大坑。解决了org.bouncycastle多个版本引起的版本冲突，遇到了bad certificate，浪费了1个多小时，终于发现是用设备A的crt，搭配了设备B的key。放在同一个文件夹里了，之前没清理干净，眼花粘错了，伤心
这个过程，先后尝试了

1. 用openssl的命令行转化出client.key对应的client.pem文件
2. 从网上搜罗另一种老版本生成SSLSocketFactory方法，将 SSLContext context = SSLContext.getInstance("TLSv1")里的改成TLSv1.2;
   终究一场空

过程简介

基于SSL连接8883，和不使用证书的唯一区别，是前者需要依赖一个SSLSocketFactory，通过语句设置到mqtt连接时的options里再执行connect。其余的publish和subscribe方法无差别。

SSLSocketFactory socketFactory = getSocketFactory(caFilePath,
                    clientCrtFilePath, clientKeyFilePath, "");
options.setSocketFactory(socketFactory);

代码

三个证书相关文件

服务端证书ca.crt
设备端证书client.crt
设备端密钥client.key (特别说明，这个文件直接用，不需要额外通过openssl将其转换成pem格式，因为在后面代码里会通过PEMParser来读取信息)
PEMParser是org.bouncycastle的新版本，PEMReader是老版本。对于那些从网上找到的代码，可以通过这个类的名称，来判断你使用了哪个版本

生成SSLSocketFactory的方法

private static SSLSocketFactory getSocketFactory(final String caCrtFile,
                                                     final String crtFile, final String keyFile, final String password)
            throws Exception {
        Security.addProvider(new BouncyCastleProvider());

        // load CA certificate
        X509Certificate caCert = null;

        FileInputStream fis = new FileInputStream(caCrtFile);
        BufferedInputStream bis = new BufferedInputStream(fis);
        CertificateFactory cf = CertificateFactory.getInstance("X.509");

        while (bis.available() > 0) {
            caCert = (X509Certificate) cf.generateCertificate(bis);
//             System.out.println(caCert.toString());
        }

        // load client certificate
        bis = new BufferedInputStream(new FileInputStream(crtFile));
        X509Certificate cert = null;
        while (bis.available() > 0) {
            cert = (X509Certificate) cf.generateCertificate(bis);
//             System.out.println(caCert.toString());
        }

        // load client private key
        PEMParser pemParser = new PEMParser(new FileReader(keyFile));
        Object object = pemParser.readObject();
        PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder()
                .build(password.toCharArray());

        JcaPEMKeyConverter converter = new JcaPEMKeyConverter()
                .setProvider("BC");
        KeyPair key;
        if (object instanceof PEMEncryptedKeyPair) {
            System.out.println("Encrypted key - we will use provided password");
            key = converter.getKeyPair(((PEMEncryptedKeyPair) object)
                    .decryptKeyPair(decProv));
        } else {
            System.out.println("Unencrypted key - no password needed");
            key = converter.getKeyPair((PEMKeyPair) object);
        }
        pemParser.close();

        // CA certificate is used to authenticate server
        KeyStore caKs = KeyStore.getInstance(KeyStore.getDefaultType());
        caKs.load(null, null);
        caKs.setCertificateEntry("ca-certificate", caCert);
        TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509");
        tmf.init(caKs);

        // client key and certificates are sent to server so it can authenticate
        // us
        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(null, null);
        ks.setCertificateEntry("certificate", cert);
        ks.setKeyEntry("private-key", key.getPrivate(), password.toCharArray(),
                new java.security.cert.Certificate[] { cert });
        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory
                .getDefaultAlgorithm());
        kmf.init(ks, password.toCharArray());

        // finally, create SSL socket factory
        SSLContext context = SSLContext.getInstance("TLSv1.2");
//        SSLContext context = SSLContext.getInstance("SSL");
        context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

        return context.getSocketFactory();
    }

生成连接options的方法

MqttConnectOptions options = new MqttConnectOptions();

            options.setConnectionTimeout(60);
            options.setKeepAliveInterval(60);
            options.setMqttVersion(MqttConnectOptions.MQTT_VERSION_3_1);


            SSLSocketFactory socketFactory = getSocketFactory(caFilePath,
                    clientCrtFilePath, clientKeyFilePath, "");

            options.setSocketFactory(socketFactory);

正式连接的方法

client.connection(options);

然后就可以愉快的玩耍了