ssl - Apache camel - 带 SSL 的 MQTT

Question

在哪里可以找到 MQTT with SSL 的确切配置设置。官方文档只有一行“支持 SSL”，但我找不到任何关于如何配置它的信息。

我看过一些论坛，但我无法从中找出任何东西。

对此有一些帮助。

P.S:在你问我我试过什么之前。我刚刚用 mqtt 作为 Camel 的组件制作了一条路线。我有几个证书，我不知道如何在这里使用它们。

Answer 1

对于正在寻找甚至不存在的说明的每个人。这是我们使用 SSL 配置 MQTT 组件。

带客户端、CA 证书和 key 的 MQTT + SSL

路线

        MQTTEndpoint mqttEndpoint = null;
        MQTTComponent mqttComponent = new MQTTComponent();
        mqttComponent.setCamelContext( this.getContext()); //Set camel context

        mqttEndpoint = (MQTTEndpoint) mqttComponent.createEndpoint("mqtt://mqtt-queue"); //mqtt://<any-name>
        mqttEndpoint.getConfiguration().setHost( "ssl://<your-ssl-broker>" );

        SSLContext sc = SSLManager
                .getSocketFactory("<ca-certificate>.crt", "<trust-certificate>.crt", "<key>.key", <password>);
        mqttEndpoint.getConfiguration().setSubscribeTopicNames("<topic>");
        mqttEndpoint.getConfiguration().setSslContext( sc );

SSL上下文

import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.openssl.PEMReader;
import org.bouncycastle.openssl.PasswordFinder;

import java.io.*;
import java.nio.file.*;
import java.security.*;
import java.security.cert.*;
import javax.net.ssl.*;


public class SSLManager
{
    public static SSLContext getSocketFactory (final String caCrtFile, final String crtFile, final String keyFile,
                                              final String password) throws Exception
    {

        Security.addProvider(new BouncyCastleProvider());

        // load CA certificate
        PEMReader reader = new PEMReader(new InputStreamReader(new ByteArrayInputStream(Files.readAllBytes(Paths.get(caCrtFile)))));
        X509Certificate caCert = (X509Certificate)reader.readObject();
        reader.close();

        // load client certificate
        reader = new PEMReader(new InputStreamReader(new ByteArrayInputStream(Files.readAllBytes(Paths.get(crtFile)))));
        X509Certificate cert = (X509Certificate)reader.readObject();
        reader.close();

        // load client private key
        reader = new PEMReader(
                new InputStreamReader(new ByteArrayInputStream(Files.readAllBytes(Paths.get(keyFile)))),
                new PasswordFinder() {
                    @Override
                    public char[] getPassword() {
                        return password.toCharArray();
                    }
                }
        );
        KeyPair key = (KeyPair)reader.readObject();
        reader.close();

        // CA certificate is used to authenticate server
        KeyStore caKs = KeyStore.getInstance(KeyStore.getDefaultType());
        caKs.load(null, null);
        caKs.setCertificateEntry("ca-certificate", caCert);
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(caKs);

        // client key and certificates are sent to server so it can authenticate us
        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(null, null);
        ks.setCertificateEntry("certificate", cert);
        ks.setKeyEntry("private-key", key.getPrivate(), password.toCharArray(), new java.security.cert.Certificate[]{cert});
        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        kmf.init(ks, password.toCharArray());

        // create SSL socket factory
        SSLContext context = SSLContext.getInstance("TLSv1.2");
        //Create socket factory if required
        //context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

        //return context.getSocketFactory();
        return context;        
    }
}

Maven 依赖

<dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk16</artifactId>
            <version>1.40</version>
        </dependency>