EMQ功能使用(一) 实现MQTTS协议

前言
　　EMQ是带有SSL功能的，需要进行简单的配置，才能使用。下面就简单说一下如何实现自签证书。

利用OpenSSL签发证书

➜ cat createCA.sh
#/bin/sh
# 生成自签名的CA key和证书
openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -subj "/CN=www.wunaozai.com" -out ca.pem

# 生成服务器端的key和证书
openssl genrsa -out server.key 2048
openssl req -new -key ./server.key -out server.csr -subj "/CN=0.0.0.0"
openssl x509 -req -in ./server.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out server.pem -days 3650 -sha256

# 生成客户端key和证书
openssl genrsa -out client.key 2048
openssl req -new -key ./client.key -out client.csr -subj "/CN=0.0.0.0"
openssl x509 -req -in ./client.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out client.pem -days 3650 -sha256

# 最后生成如下文件
➜ ls
ca.key ca.pem ca.srl client.csr client.key client.pem createCA.sh server.csr server.key server.pem

配置到EMQX的emqx.conf
　　如果启用单向认证的话，客户端不需要证书都可以连接。这里的listener.ssl.external.fail_if_no_peer_cert = true 注释掉就启用单向认证。启用双向认证。那么客户端就必须导入CA和client的证书才可以连接。

listener.ssl.external = 8883
listener.ssl.external.acceptors = 16
listener.ssl.external.max_connections = 102400
listener.ssl.external.max_conn_rate = 500
listener.ssl.external.active_n = 100
listener.ssl.external.zone = external
listener.ssl.external.access.1 = allow all
listener.ssl.external.handshake_timeout = 15s
listener.ssl.external.keyfile = ../certs/server.key
listener.ssl.external.certfile = ../certs/server.pem
listener.ssl.external.cacertfile = ../certs/ca.pem
listener.ssl.external.verify = verify_peer
listener.ssl.external.fail_if_no_peer_cert = true
listener.ssl.external.ciphers = ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA384,ECDHE-RSA-AES256-SHA384,ECDHE-ECDSA-DES-CBC3-SHAAES256-GCM-SHA384,ECDH-ECDSA-AES256-SHA384,ECDH-RSA-AES256-SHA384,DHE-DSS-AES256-GCM-SHA384,DHE-DSS-AES256-SHA256,AES256-GCM-SHA384,AES256-SHA256,ECDHE-ECDSA-AES128,ECDHE-ECDSA-AES128-SHA256,ECDHE-RSA-AES128-SHA256,ECDH-ECDSA-AES128-GCM-SHA256,ECDH-RSA-AES128-GCM-SHA256,ECDH-ECDSA-AES128-SHA256,ECDH-RSA-AES128-SHA256,DHE-DSS-AAES128-GCM-SHA256,AES128-SHA256,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,DHE-DSS-AES256-SHA,ECDH-ECDSA-AES256-SHA,ECDH-RSA-AES256-SHA,AES256-SHA,ECDHE-ECDSA-AES1128-SHA,ECDH-ECDSA-AES128-SHA,ECDH-RSA-AES128-SHA,AES128-SHA
listener.ssl.external.reuseaddr = true

重新启动EMQX

1 ./bin/emqx stop
2 ./bin/emqx start

工具测试
我这里使用EMQ官方出品的MQTTX工具

image.png
image.png

参考：https://www.cnblogs.com/wunaozai/p/12367497.html