Question

我在java中创建了一个MQTT Broker和一个客户端。它也可以完美地使用SSL。使用paho libs使用java编写的代理服务器和客户端，启用SSL很容易。我们只需要将URL中的协议从tcp切换到ssl IE：ssl：//.messaging.internetofthings.ibmcloud.com：8883并在te src代码中设置一些道具：

java.util.Properties sslClientProps = new java.util.Properties();
sslClientProps.setProperty("com.ibm.ssl.protocol", "TLSv1.2");
options.setSSLProperties(sslClientProps);

在SSLContext上

SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
sslContext.init(null, null, null);

创建安全且加密的连接（检查使用WireShark嗅探数据包）。

使用特定的CA可信证书也很有效（messaging.pem文件）

CertificateFactory cf = CertificateFactory.getInstance("X.509");
InputStream certFile = MqttHandler.class.getResourceAsStream("messaging.pem");
Certificate ca = cf.generateCertificate(certFile);
KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
keyStore.load(null, null);
keyStore.setCertificateEntry("ca", ca);
TrustManager trustManager = TrustManagerUtils.getDefaultTrustManager(keyStore);
SSLContext sslContext = SSLContextUtils.createSSLContext("TLSv1.2", null, trustManager);
options.setSocketFactory(sslContext.getSocketFactory());

我需要使用Android客户端和自定义MQTT Java Server Broker （不使用SSL，MQTT发布和订阅也适用于Android）。

麻烦似乎与从Android创建 SSLSocketFactory 有关。

我做了这个测试：

1）设置SSL道具（正如我在上面报告的java客户端的src中所做的那样）

2）在Android客户端上传递CA可信证书（正如我在上面报告的java客户端的src中所做的那样）

3）以BouncyCastle格式（与Android兼容）从受信任的CA生成密钥库，如此处http://rijware.com/accessing-a-secure-mqtt-broker-with-android/所示，并在Android客户端上传递密钥库：

CertificateFactory cf = CertificateFactory.getInstance("X.509");
InputStream keyStoreFile = getAssets().open("raw_key_file");
//keystore trusted
KeyStore keystoreTrust = KeyStore.getInstance("BKS");//Bouncy Castle format for Android
keystoreTrust.load(keyStoreFile, "mykeystorepassword".toCharArray());
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init(keystoreTrust);
SLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, trustManagerFactory.getTrustManagers(), new SecureRandom());
options.setSocketFactory(sslContext.getSocketFactory());

4）使用本地信任存储（CA）和客户端证书：

// use local trust store (CA)
TrustManagerFactory tmf;
CertificateFactory cf = CertificateFactory.getInstance("X.509");
InputStream srvIn = getAssets().open("messaging.pem");
Certificate ca = cf.generateCertificate(srvIn);
KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
keyStore.load(null, null);
keyStore.setCertificateEntry("ca", ca);
tmf = TrustManagerFactory.getInstance("X509");
tmf.init(keyStore);
// load client certificate
KeyStore clientKeyStore = null;
InputStream clIn = getAssets().open("raw_key_file");
clientKeyStore = KeyStore.getInstance("BKS");
clientKeyStore.load(clIn, "mykeystorepassword".toCharArray());
KeyManagerFactory kmf = KeyManagerFactory.getInstance("X509");
kmf.init(clientKeyStore, "mykeystorepassword".toCharArray());
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
options.setSocketFactory(sslContext.getSocketFactory());

不幸的是，我仍然遇到了这个错误： MqttException（0） - javax.net.ssl.SSLException：连接被同行关闭

MqttException (0) - javax.net.ssl.SSLException: Connection closed by peer
at org.eclipse.paho.client.mqttv3.internal.ExceptionHelper.createMqttException(ExceptionHelper.java:38)
org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:604)
at java.lang.Thread.run(Thread.java:841)
Caused by: javax.net.ssl.SSLException: Connection closed by peer
at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:405)
at org.eclipse.paho.client.mqttv3.internal.SSLNetworkModule.start(SSLNetworkModule.java:89)
at org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:590)

也许我仍然对证书流程感到困惑。如何从头开始创建这些并在服务器和客户端使用（创建与Android兼容的BouncyCastle格式的密钥库）？或者也许我在Android中使用SSLSocketFactory类做错了...

谢谢，任何建议都非常适合。

通过MQTT用ssl连接android设备

0 个答案: