SSL/TLS connection #396

zhujieshan · 2017-11-15T07:15:14Z

I have ca.crt, client.crt, client.key
how can I connect mqtt?

self.session = [[MQTTSession alloc] initWithClientId:@"clientid"
                                                    userName:@"username"
                                                    password:@"password"
                                                   keepAlive:60
                                                cleanSession:YES
                                                        will:NO
                                                   willTopic:nil
                                                     willMsg:nil
                                                     willQoS:0
                                              willRetainFlag:NO
                                               protocolLevel:4
                                                     runLoop:[NSRunLoop currentRunLoop]
                                                     forMode:NSRunLoopCommonModes
                                              securityPolicy:[self customSecurityPolicy]
                                                certificates:nil];
    [self.session connectToHost:transport.host port:transport.port usingSSL:YES];

- (MQTTSSLSecurityPolicy *)customSecurityPolicy
{
    NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"ca" ofType:@"crt"];
    NSString *clientcerPath = [[NSBundle mainBundle] pathForResource:@"client" ofType:@"crt"];
    NSString *clientkeyPath = [[NSBundle mainBundle] pathForResource:@"client" ofType:@"key"];

    NSData *certData = [NSData dataWithContentsOfFile:cerPath];
    NSData *certData1 = [NSData dataWithContentsOfFile:clientcerPath];
    NSData *certData2 = [NSData dataWithContentsOfFile:clientkeyPath];
    
    MQTTSSLSecurityPolicy *securityPolicy = [MQTTSSLSecurityPolicy policyWithPinningMode:MQTTSSLPinningModeNone];
    
    securityPolicy.allowInvalidCertificates = YES;
    securityPolicy.validatesCertificateChain = YES;
    securityPolicy.validatesDomainName = NO;
    securityPolicy.pinnedCertificates = @[certData,certData1,certData2];
    return securityPolicy;
}

right?

The text was updated successfully, but these errors were encountered:

willem4ever · 2017-11-15T12:52:13Z

I have below working for asynchronous connect ...

session = [[MQTTSession alloc] init];
NSString*  ca1 = [[NSBundle bundleForClass:[MQTTSession class]] pathForResource:@“xxxxxx” ofType:@"der"];
NSString*  ca2 = [[NSBundle bundleForClass:[MQTTSession class]] pathForResource:@“yyyyyy” ofType:@"der"];
MQTTSSLSecurityPolicy *securityPolicy = [MQTTSSLSecurityPolicy policyWithPinningMode:MQTTSSLPinningModeCertificate];
securityPolicy.pinnedCertificates = @[[NSData dataWithContentsOfFile:ca1],[NSData dataWithContentsOfFile:ca2]];
securityPolicy.allowInvalidCertificates = YES;
securityPolicy.validatesDomainName = YES;
securityPolicy.validatesCertificateChain = NO;
//
MQTTSSLSecurityPolicyTransport *secureTransport = [[MQTTSSLSecurityPolicyTransport alloc] init];
secureTransport.port = (uint32_t) c.port;
secureTransport.host = c.broker;
secureTransport.tls = (c.ssl) ? true : false;
secureTransport.securityPolicy = securityPolicy;
session.transport = secureTransport;
//
session.userName = c.username;
session.password = c.password;
session.delegate = self;

[session connect];

zhujieshan · 2017-11-16T02:21:37Z

MQTTSSLSecurityPolicyTransport *transport = [[MQTTSSLSecurityPolicyTransport alloc]init];
transport.host = d[@"host"];
transport.port = [d[@"port"] intValue];
transport.tls = YES;

NSString *cerPath = [[NSBundle mainBundle] pathForResource:@"ca" ofType:@"der"];
NSString *clientcerPath = [[NSBundle mainBundle] pathForResource:@"client" ofType:@"der"];
        
MQTTSSLSecurityPolicy *securityPolicy = [MQTTSSLSecurityPolicy policyWithPinningMode:MQTTSSLPinningModeCertificate];
securityPolicy.pinnedCertificates = @[[NSData dataWithContentsOfFile:cerPath],[NSData dataWithContentsOfFile:clientcerPath]];
securityPolicy.allowInvalidCertificates = YES;
securityPolicy.validatesDomainName = YES;
securityPolicy.validatesCertificateChain = NO;
transport.securityPolicy = securityPolicy;
        
_session = [[MQTTSession alloc] init];
_session.transport = transport;
_session.delegate = self;
_session.userName = @"username";
 _session.password = @"password";
        
[_session connect];

I converted the format of the certificate,and MQTT still can't connect,Are you using 'Two-way certification'? Do not need a client key(client.key)?

zhujieshan · 2017-11-16T03:32:45Z

NSString* ca1 = [[NSBundle bundleForClass:[MQTTSession class]] pathForResource:@“xxxxxx” ofType:@"der"];
NSString* ca2 = [[NSBundle bundleForClass:[MQTTSession class]] pathForResource:@“yyyyyy” ofType:@"der"];

ca1 and ca2 conversion before what format? p12?

jcavar · 2017-11-16T09:41:36Z

Can you just please use code formatting, it makes it a lot easier to read comments.

willem4ever · 2017-11-16T09:50:29Z

No I do not use a client key, the format of the certificates is openssl der format. Have you checked a valid path is returned. You can also try "securityPolicy.validatesDomainName = NO;" Additionally you check the MQTT side of things by using openssl to connect to the MQTT broker

willem4ever · 2017-11-16T12:01:12Z

Ok to use a client certificate you need to do few more things

 NSString*  client = [[NSBundle bundleForClass:[MQTTSession class]] pathForResource:@"client" ofType:@"p12"];

attach the client certificate (P12) to the security policy

MQTTSSLSecurityPolicyTransport *secureTransport = [[MQTTSSLSecurityPolicyTransport alloc] init];
secureTransport.port = (uint32_t) c.port;
secureTransport.host = c.broker;
secureTransport.tls = true;
secureTransport.securityPolicy = securityPolicy;
secureTransport.certificates = [MQTTSSLSecurityPolicyTransport clientCertsFromP12:client passphrase:@"password"];
session.transport = secureTransport;

Do not forget to add the certificates to your bundle .....

zhujieshan · 2017-11-17T02:23:37Z

You really helped me a great favor!This method is useful!Thanks!

NSString* ca = [[NSBundle bundleForClass:[MQTTSession class]] pathForResource:@"ca" ofType:@"der"];
NSString* client = [[NSBundle bundleForClass:[MQTTSession class]] pathForResource:@"certificate" ofType:@"p12"];

MQTTSSLSecurityPolicyTransport *transport = [[MQTTSSLSecurityPolicyTransport alloc]init];
transport.certificates = [MQTTSSLSecurityPolicyTransport clientCertsFromP12:client passphrase:@"password"];

MQTTSSLSecurityPolicy *securityPolicy = [MQTTSSLSecurityPolicy policyWithPinningMode:MQTTSSLPinningModeCertificate];
securityPolicy.pinnedCertificates = @[[NSData dataWithContentsOfFile:ca]];

cjw429672039 · 2017-11-17T07:45:58Z

你好，请教下：
1.你使用的证书是自签证书还是从信任的证书机构购买的证书？
2.证书只能用信任机构颁发的证书吗？

willem4ever · 2017-11-17T07:50:04Z

你好，请教下：
1.你使用的证书是自签证书还是从信任的证书机构购买的证书？
2.证书只能用信任机构颁发的证书吗？

Hello, ask:

Are you using a self-signed certificate or a certificate purchased from a trusted certificate authority?
Certificates can only be issued by a certificate of trust?

I'm using self signed certificates ...

zhujieshan · 2017-11-18T03:38:34Z

我也是使用的是自签证书后台搞定的

jcavar · 2018-01-04T15:47:50Z

It seems like issue here is resolved but feel free to reopen if not.

MrLinTianbao · 2018-02-06T09:40:24Z

Excuse me, what's going on? Error Domain=NSOSStatusErrorDomain Code=-9807 "(null)" UserInfo={_kCFStreamErrorCodeKey=-9807, _kCFStreamErrorDomainKey=3}

kuangzq · 2018-09-12T05:46:06Z

Ok to use a client certificate you need to do few more things

 NSString*  client = [[NSBundle bundleForClass:[MQTTSession class]] pathForResource:@"client" ofType:@"p12"];

attach the client certificate (P12) to the security policy

MQTTSSLSecurityPolicyTransport *secureTransport = [[MQTTSSLSecurityPolicyTransport alloc] init];
secureTransport.port = (uint32_t) c.port;
secureTransport.host = c.broker;
secureTransport.tls = true;
secureTransport.securityPolicy = securityPolicy;
secureTransport.certificates = [MQTTSSLSecurityPolicyTransport clientCertsFromP12:client passphrase:@"password"];
session.transport = secureTransport;

Do not forget to add the certificates to your bundle .....

The framework crashed when connecting to broker with client certificate. My code is

    NSString *sHost = @"mqtt.myserver.com";
    UInt32 port = 1883;

    NSString *sClientP12Path = [[NSBundle bundleForClass:[self class]] pathForResource:@"client" ofType:@"p12"];
    NSData *clientP12Data = [NSData dataWithContentsOfFile:sClientP12Path];

    MQTTSSLSecurityPolicy *securityPolicy = [MQTTSSLSecurityPolicy policyWithPinningMode:MQTTSSLPinningModeCertificate];    securityPolicy.pinnedCertificates = @[clientP12Data];
    securityPolicy.allowInvalidCertificates = YES;

    MQTTSSLSecurityPolicyTransport *secureTransport = [[MQTTSSLSecurityPolicyTransport alloc] init];
    secureTransport.port = port;
    secureTransport.host = sHost;
    secureTransport.tls = YES;
    secureTransport.securityPolicy = securityPolicy;
    secureTransport.certificates = [MQTTSSLSecurityPolicyTransport clientCertsFromP12:sClientP12 passphrase:@"password"];
    
    MQTTSession *session = [[MQTTSession alloc] initWithClientId:@"MQTTOverTLS" userName:nil password:nil keepAlive:60 cleanSession:YES will:YES willTopic:@"BYE" willMsg:[@"Client off-line" dataUsingEncoding:NSUTF8StringEncoding] willQoS:2 willRetainFlag:YES protocolLevel:4 runLoop:[NSRunLoop currentRunLoop] forMode:NSRunLoopCommonModes securityPolicy:securityPolicy certificates:@[clientP12Data]];
    session.transport = secureTransport;
    [session connectWithConnectHandler:^(NSError *error) {
        if (error) {
            NSLog(@"error: %@", error.description);
        }
    }];

It crashed here in the framework

Some debug information around the crash breakpoint

The version of framework (from Podfile.lock)

  - MQTTClient (0.9.9):
    - MQTTClient/Core (= 0.9.9)
  - MQTTClient/Core (0.9.9):
    - MQTTClient/Manager
    - MQTTClient/Min
  - MQTTClient/Manager (0.9.9):
    - MQTTClient/Min
  - MQTTClient/Min (0.9.9)

Did I miss something or do something wrong? Asking for help. Any advice would be highly appreciated.

marciogranzotto · 2018-12-20T17:05:49Z

Did I miss something or do something wrong? Asking for help. Any advice would be highly appreciated.

Same thing for me. Did you manage to fix it? @kuangzq

ZLDamo · 2020-02-27T09:46:55Z

我也是使用的是自签证书后台搞定的
您好,请问为什么您最后用的[NSBundle bundleForClass:[MQTTSession class]] 方法,而不是[NSBundle mainBundle] pathForResource: 方法呢? 您是改了证书的名字嘛?您用的两个证书对应的是ca.crt,client.cer,client.key中的哪两个呢?

kuangzq · 2020-02-27T18:40:15Z

It has been quite a long time and couldn’t remember the details. But I think I must have tried pathForResource first, and found it didn’t work, then I tried something else.

On Thu, Feb 27, 2020 at 03:46 Damo ***@***.***> wrote: 我也是使用的是自签证书后台搞定的您好,请问为什么您最后用的[NSBundle bundleForClass:[MQTTSession class]] 方法,而不是[NSBundle mainBundle] pathForResource: 方法呢? 您是改了证书的名字嘛?您用的两个证书对应的是ca.crt,client.cer,client.key中的哪两个呢? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#396?email_source=notifications&email_token=ADSBFQSUBSFRWRCB4FVBBJLRE6DZBA5CNFSM4EDZ7QAKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOENDVS2I#issuecomment-591878505>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADSBFQWT7POTU5RNP56IXVDRE6DZBANCNFSM4EDZ7QAA> .

-- Zhengqian (John) Kuang

ZLDamo · 2020-02-28T01:56:25Z

It has been quite a long time and couldn’t remember the details. But I think I must have tried pathForResource first, and found it didn’t work, then I tried something else.
On Thu, Feb 27, 2020 at 03:46 Damo @.***> wrote: 我也是使用的是自签证书后台搞定的您好,请问为什么您最后用的[NSBundle bundleForClass:[MQTTSession class]] 方法,而不是[NSBundle mainBundle] pathForResource: 方法呢? 您是改了证书的名字嘛?您用的两个证书对应的是ca.crt,client.cer,client.key中的哪两个呢? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#396?email_source=notifications&email_token=ADSBFQSUBSFRWRCB4FVBBJLRE6DZBA5CNFSM4EDZ7QAKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOENDVS2I#issuecomment-591878505>, or unsubscribe https://github.com/notifications/unsubscribe-auth/ADSBFQWT7POTU5RNP56IXVDRE6DZBANCNFSM4EDZ7QAA .
-- Zhengqian (John) Kuang
Where is your certificate? Is it mainBundle or somewhere else?

procjiang · 2021-01-27T09:17:22Z

[MQTTCFSocketTransport] Error while importing pkcs12 为什么会报错啊？我使用的方式有问题吗？
NSString *ca = [[NSBundle bundleForClass:[MQTTSession class]] pathForResource:@"cacert" ofType:@"der"];
NSString *client = [[NSBundle bundleForClass:[MQTTSession class]] pathForResource:@"client" ofType:@"p12"];
MQTTSSLSecurityPolicyTransport *transport = [[MQTTSSLSecurityPolicyTransport alloc]init];
transport.host = host;
transport.port = port;
transport.tls = YES;
MQTTSSLSecurityPolicy *securityPolicy = [MQTTSSLSecurityPolicy policyWithPinningMode:MQTTSSLPinningModeCertificate];
securityPolicy.allowInvalidCertificates = YES;
securityPolicy.validatesDomainName = NO;
securityPolicy.validatesCertificateChain = NO;
securityPolicy.pinnedCertificates = @[[NSData dataWithContentsOfFile:ca]];
transport.securityPolicy = securityPolicy;
[self.sessionManager connectTo:host
port:port
tls:YES
keepalive:60
clean:NO
auth:YES
user:[CYUserInfo shareUserInfo].uid
pass:[CYUserInfo shareUserInfo].access_token
will:YES
willTopic:@""
willMsg:nil
willQos:0
willRetainFlag:NO
withClientId:clientId
securityPolicy:securityPolicy
certificates:[MQTTSSLSecurityPolicyTransport clientCertsFromP12:client passphrase:@"password"]];

jcavar closed this as completed Jan 4, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SSL/TLS connection #396

SSL/TLS connection #396

zhujieshan commented Nov 15, 2017 •

edited by jcavar

willem4ever commented Nov 15, 2017 •

edited

zhujieshan commented Nov 16, 2017 •

edited by jcavar

zhujieshan commented Nov 16, 2017 •

edited by jcavar

jcavar commented Nov 16, 2017 •

edited

willem4ever commented Nov 16, 2017

willem4ever commented Nov 16, 2017 •

edited

zhujieshan commented Nov 17, 2017 •

edited

cjw429672039 commented Nov 17, 2017

willem4ever commented Nov 17, 2017

zhujieshan commented Nov 18, 2017

jcavar commented Jan 4, 2018

MrLinTianbao commented Feb 6, 2018

kuangzq commented Sep 12, 2018

marciogranzotto commented Dec 20, 2018

ZLDamo commented Feb 27, 2020

kuangzq commented Feb 27, 2020 via email

ZLDamo commented Feb 28, 2020

procjiang commented Jan 27, 2021

SSL/TLS connection #396

SSL/TLS connection #396

Comments

zhujieshan commented Nov 15, 2017 • edited by jcavar

willem4ever commented Nov 15, 2017 • edited

zhujieshan commented Nov 16, 2017 • edited by jcavar

zhujieshan commented Nov 16, 2017 • edited by jcavar

jcavar commented Nov 16, 2017 • edited

willem4ever commented Nov 16, 2017

willem4ever commented Nov 16, 2017 • edited

zhujieshan commented Nov 17, 2017 • edited

cjw429672039 commented Nov 17, 2017

willem4ever commented Nov 17, 2017

zhujieshan commented Nov 18, 2017

jcavar commented Jan 4, 2018

MrLinTianbao commented Feb 6, 2018

kuangzq commented Sep 12, 2018

marciogranzotto commented Dec 20, 2018

ZLDamo commented Feb 27, 2020

kuangzq commented Feb 27, 2020 via email

ZLDamo commented Feb 28, 2020

procjiang commented Jan 27, 2021

zhujieshan commented Nov 15, 2017 •

edited by jcavar

willem4ever commented Nov 15, 2017 •

edited

zhujieshan commented Nov 16, 2017 •

edited by jcavar

zhujieshan commented Nov 16, 2017 •

edited by jcavar

jcavar commented Nov 16, 2017 •

edited

willem4ever commented Nov 16, 2017 •

edited

zhujieshan commented Nov 17, 2017 •

edited