mqtt tls config

mqtt-tls.md

MQTT TLS config

These are some rough notes for deploying a test/dev local CA, a server key/cert, and a client key/cert. The intention is to provide a quick and dirty (don't use in production) local CA with one server and one client.

Easy-rsa

Follow the install guide for easy-rsa (https://github.com/OpenVPN/easy-rsa)

Init PKI

./easyrsa init-pki

Build CA

./easyrsa build-ca

Generate CSR and key for server 'localhost'

./easyrsa gen-req localhost

Sign request; generate cert

!!Notice the 'server' param!!

./easyrsa sign-req server localhost

Generate CSR and key for user 'user001'

./easyrsa gen-req user001

Sign request; generate cert

!!Notice the 'client' param!!

./easyrsa sign-req client user001

For each of the keys, decrypt.

openssl rsa -in crypted.key -out decrypted.key

easy-rsa crt files contain both the text and cert parts. For ease of use, copy just the PEM key part to a new file.

Generate server PEM

HAProxy requires the server cert/key to be in PEM format. Be sure the key is decrypted and the cert is extracted from the file genereated.

cat ../private/localhost.key ../certs/localhost.crt ../certs/ca.crt > localhost.pem

mosquitto config

add lines to /etc/mosquitto/mosquitto.conf

listener 8884

cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/mqtt.kodea.no.crt
keyfile /etc/mosquitto/certs/mqtt.kodea.nokey.key
require_certificate true
use_identity_as_username true
crlfile /etc/mosquitto/certs/crl.pem