MQTT安全：使用ssl实现EMQ与android客户端安全通信

使用 SSL 对 MQTT的消息交换进行加密，提高安全性。

服务端使用的是 EMQ v2.0
客户端使用的是 Eclipse Paho Android Service

服务器启用SSL

我们需要数字证书来对进行ssl通信用户进行强认证。由于获得一个真正受外界信任的证书需要花费money，所有我们采用自签名证书。

要实现双向认证（服务器认证客户端、客户端认证服务器）我们需要3个证书，一个CA证书，一个EMQ服务器证书，一个客户端证书。

具体的生成证书操作、启用EMQ ssl和双向认证，参考这篇文章 Securing EMQ Connections with SSL

android客户端的ssl实现

上一步我们生成了客户端使用的证书 MyClient1.pem 和私有秘钥MyClient1.key，但是要想在android上使用需要将其转成bks格式。

pem 转 bks

1、首先生成.p12文件：

1	openssl pkcs12 -export -nodes -in MyClient1.pem -inkey MyClient1.key -out client.p12

-inkey为私钥文件
-in为证书，如果pem私钥没有密码，则使用-nodes表示无密码，如果有密码使用-passin；如果私钥和证书都在同一文件里则-in和-inkey指定同一个文件。

会提示输入给.p12秘钥库设置的密码，请记住，下面会用到

2、生成.bks证书：

keytool -importkeystore -srckeystore client.p12 -srcstoretype pkcs12 -destkeystore client.bks -deststoretype bks -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath bcprov-ext-jdk15on-158.jar

使用 KeyTool 转换为 BKS 格式时，需要 bcprov-ext-jdk15on-158.jar，可以在这里找到。文件路径直接带在-providerpath 参数后面即可。也可以把jar包放到如下路径：jdk/jre/lib/ext，从而省略-providerpath。

会首先提示输入给bks秘钥库设置的密码，请记住，下面会用到。

然后会提示输入p12秘钥库密码，即上一步设置的密码。

3、查看bks证书库列表进行验证

1	keytool -list -rfc -keystore client.bks -storetype BKS -provider org.bouncycastle.jce.provider.BouncyCastleProvider -storepass 'bks秘钥库密码'

源码

完整源码见 GitHub

主要代码

package paho.android.mqtt_example;

import android.util.Log;
import java.io.IOException;
import java.io.InputStream;
import java.net.InetAddress;
import java.net.Socket;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.security.cert.CertificateException;
import timber.log.Timber;

/**
 * Original SocketFactory file taken from https://github.com/owntracks/android
 */

public class SelfSignedSocketFactory extends javax.net.ssl.SSLSocketFactory {
    private javax.net.ssl.SSLSocketFactory factory;


    public static class SocketFactoryOptions {

        private InputStream caCrtInputStream;
        private InputStream caClientBksInputStream;
        private String caClientBksPassword;


        /**
         *
         * @param stream the self-signed Root CA Certificate's stream
         * @return
         */
        public SocketFactoryOptions withCaInputStream(InputStream stream) {
            this.caCrtInputStream = stream;
            return this;
        }


        /**
         *
         * @param stream the self-signed client Certificate's stream .
         * @return
         */
        public SocketFactoryOptions withClientBksInputStream(InputStream stream) {
            this.caClientBksInputStream = stream;
            return this;
        }


        public SocketFactoryOptions withClientBksPassword(String password) {
            this.caClientBksPassword = password;
            return this;
        }


        public boolean hasCaCrt() {
            return caCrtInputStream != null;
        }


        public boolean hasClientBksCrt() {
            return caClientBksPassword != null;
        }


        public InputStream getCaCrtInputStream() {
            return caCrtInputStream;
        }


        public InputStream getCaClientBksInputStream() {
            return caClientBksInputStream;
        }


        public String getCaClientBksPassword() {
            return caClientBksPassword;
        }


        public boolean hasClientBksPassword() {
            return (caClientBksPassword != null) && !caClientBksPassword.equals("");
        }
    }


    public SelfSignedSocketFactory()
        throws CertificateException, KeyStoreException, NoSuchAlgorithmException, IOException, KeyManagementException,
               java.security.cert.CertificateException, UnrecoverableKeyException {
        this(new SocketFactoryOptions());
    }


    private TrustManagerFactory tmf;


    public SelfSignedSocketFactory(SocketFactoryOptions options)
        throws KeyStoreException, NoSuchAlgorithmException, IOException, KeyManagementException,
               java.security.cert.CertificateException, UnrecoverableKeyException {
        Log.v(this.toString(), "initializing CustomSocketFactory");

        tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        KeyManagerFactory kmf = KeyManagerFactory.getInstance("X509");

        if (options.hasCaCrt()) {
            Log.v(this.toString(), "MQTT_CONNECTION_OPTIONS.hasCaCrt(): true");
            // CA certificate is used to authenticate server
            CertificateFactory cAf = CertificateFactory.getInstance("X.509");
            X509Certificate ca = (X509Certificate) cAf.generateCertificate(options.getCaCrtInputStream());
            KeyStore caKs = KeyStore.getInstance(KeyStore.getDefaultType());
            caKs.load(null, null);
            caKs.setCertificateEntry("ca-certificate", ca);
            tmf.init(caKs);
        } else {
            Timber.v("CA sideload: false, using system keystore");
            KeyStore keyStore = KeyStore.getInstance("AndroidCAStore");
            keyStore.load(null);
            tmf.init(keyStore);
        }

        if (options.hasClientBksCrt()) {
            Log.v(this.toString(), "MQTT_CONNECTION_OPTIONS.hasClientBksCrt(): true");

            // init client key store
            KeyStore clientkeyStore = KeyStore.getInstance("BKS");
            clientkeyStore.load(options.getCaClientBksInputStream(),
                options.hasClientBksPassword() ? options.getCaClientBksPassword().toCharArray() : new char[0]);
            kmf.init(clientkeyStore,
                options.hasClientBksPassword() ? options.getCaClientBksPassword().toCharArray() : new char[0]);

        } else {
            Log.v(this.toString(), "Client .bks sideload: false, using null CLIENT cert");
            kmf.init(null, null);
        }

        // Create an SSLContext that uses our TrustManager
        SSLContext context = SSLContext.getInstance("TLSv1.2");
        context.init(kmf.getKeyManagers(), getTrustManagers(), null);
        this.factory = context.getSocketFactory();

    }


    public TrustManager[] getTrustManagers() {
        return tmf.getTrustManagers();
    }


    @Override
    public String[] getDefaultCipherSuites() {
        return this.factory.getDefaultCipherSuites();
    }


    @Override
    public String[] getSupportedCipherSuites() {
        return this.factory.getSupportedCipherSuites();
    }


    @Override
    public Socket createSocket() throws IOException {
        SSLSocket r = (SSLSocket) this.factory.createSocket();
        r.setEnabledProtocols(new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" });
        return r;
    }


    @Override
    public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {
        SSLSocket r = (SSLSocket) this.factory.createSocket(s, host, port, autoClose);
        r.setEnabledProtocols(new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" });
        return r;
    }


    @Override
    public Socket createSocket(String host, int port) throws IOException {

        SSLSocket r = (SSLSocket) this.factory.createSocket(host, port);
        r.setEnabledProtocols(new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" });
        return r;
    }


    @Override
    public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException {
        SSLSocket r = (SSLSocket) this.factory.createSocket(host, port, localHost, localPort);
        r.setEnabledProtocols(new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" });
        return r;
    }


    @Override
    public Socket createSocket(InetAddress host, int port) throws IOException {
        SSLSocket r = (SSLSocket) this.factory.createSocket(host, port);
        r.setEnabledProtocols(new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" });
        return r;
    }


    @Override
    public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort)
        throws IOException {
        SSLSocket r = (SSLSocket) this.factory.createSocket(address, port, localAddress, localPort);
        r.setEnabledProtocols(new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" });
        return r;
    }
}