Question

我已在端口8883和端口1883上为ubuntu实施了mosquitto代理，无法弄清楚为什么我仍然收到如下所示的与CA相关的错误。

当我在服务器上本地使用mosquitto_pub对其进行测试时以及在我的MacBook上使用Paho / Python脚本作为客户端时，都会发生这种情况。我的mosquitto.config文件，mosquitto_pub命令和我的mosquitto日志消息如下所示。我还包括了我的openssl证书创建命令，以防万一我做错了什么。

这是我的mosquitto.conf文件

# Place your local configuration in /etc/mosquitto/conf.d/
# A full description of the configuration file is at
# /usr/share/doc/mosquitto/examples/mosquitto.conf.example

pid_file /var/run/mosquitto.pid

persistence true
persistence_location /var/lib/mosquitto/

#log_dest file /var/log/mosquitto/mosquitto.log
log_dest stdout

include_dir /etc/mosquitto/conf.d

log_type all

#-----------------------------------------------
#Default Listener
#-----------------------------------------------

port 8883

#------------------------------------------------
#Certificate Based SSL/TLS Support
#------------------------------------------------

cafile /../etc/mosquitto/ca_certificates/ca.crt
keyfile /../etc/mosquitto/certs/server.key
certfile /../etc/mosquitto/certs/server.crt

listener 1883

这是我用来测试的mosquitto_pub命令。

sudo mosquitto_pub -h 305.875.987.34 -t test -m "Typing this" -p 8883 --cafile /../etc/mosquitto/ca_certificates/ca.crt

这是蚊帐在我运行时所说的。

1546507891: mosquitto version 1.5.5 starting
1546507891: Config loaded from /../etc/mosquitto/mosquitto.conf.
1546507891: Opening ipv4 listen socket on port 1883.
1546507891: Opening ipv6 listen socket on port 1883.
1546507891: Opening ipv4 listen socket on port 8883.
1546507891: Opening ipv6 listen socket on port 8883.
1546507929: New connection from 305.875.987.34 on port 8883.
1546507929: OpenSSL Error: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
1546507929: Socket error on client <unknown>, disconnecting.

这些是我用来创建ca.crt，server.crt和server.key的openssl命令。我在名为certs的文件夹中创建了它们。

openssl genrsa -des3 -out ca.key 2048
openssl req -new -x509 -days 1826 -key ca.key -out ca.crt
openssl genrsa -out server.key 2048
openssl req -new -out server.csr -key server.key
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 360

然后我在删除旧的ca.crt后将ca.crt移至/../etc/mosquitto/ca_certifications，我已尝试解决此问题。我是通过以下两个命令完成的。

sudo rm /../etc/mosquitto/ca_certifications/ca.crt
sudo mv ca.crt /../etc/mosquitto/ca_certifications

除了将它们放在/../etc/mosquitto/certs中之外，我对server.crt和server.key也做了同样的事情。

代理似乎在1883端口上工作正常。

如果您需要更多信息，请告诉我。

Answer 1

首先，我将重新排列您的mosquitto.conf，以使与链接的内容更加明显，并删除证书/密钥文件的相对路径，如下所示：

# Place your local configuration in /etc/mosquitto/conf.d/
# A full description of the configuration file is at
# /usr/share/doc/mosquitto/examples/mosquitto.conf.example

pid_file /var/run/mosquitto.pid

persistence true
persistence_location /var/lib/mosquitto/

#log_dest file /var/log/mosquitto/mosquitto.log
log_dest stdout

include_dir /etc/mosquitto/conf.d

log_type all

#-----------------------------------------------
#Default Listener
#-----------------------------------------------

port 1883

#------------------------------------------------
#Certificate Based SSL/TLS Support
#------------------------------------------------
listener 8883
cafile /etc/mosquitto/ca_certificates/ca.crt
keyfile /etc/mosquitto/certs/server.key
certfile /etc/mosquitto/certs/server.crt

我交换了端口/侦听器条目，以很明显地将SSL设置绑定到端口8883侦听器。我还从路径的开头删除了/../，因为这是没有意义的，因为不可能从/“ root”上移一个目录。

同样，您应该对mosquitto_pub命令使用直接路径。

此外，当您以root身份（使用sudo）复制文件时，请确保mosquitto用户可以读取cert / key文件。

在运行Mosquitto的服务器上使用SSL时收到错误消息吗？

1 个答案: