ssl双向认证

环境信息

  • EMQX 版本:5.0.7
  • 操作系统及版本:docker容器
  • 其他

问题描述

我在本地创建了ca自签证书,然后用ca证书生成了client-key.pem,clientCert.pem,server-key.pem,serverCert.pem,然后用client-key.pem和clientCert.pem生成了keystore文件,将keystore添加serverCert.pem证书用java客户端连接失败debug:Software caused connection abort: recv failed

配置文件及日志

[error] supervisor: 'esockd_connection_sup - <0.2168.0>', errorContext: connection_shutdown, reason: {ssl_error,{tls_alert,{bad_certificate,"TLS server: In state certify at ssl_handshake.erl:2030 generated SERVER ALERT: Fatal - Bad Certificate\n"}}}, offender: [{pid,<0.2579.0>},{name,connection},{mfargs,{emqx_connection,start_link,[#{enable_authn => true,limiter => #{bytes_in => #{capacity => 1099511627776,initial => 0,rate => infinity},client => #{bytes_in => #{capacity => 1099511627776,divisible => false,failure_strategy => force,initial => 0,low_watermark => 0,max_retry_time => 10000,rate => infinity},connection => #{capacity => 1099511627776,divisible => false,failure_strategy => force,initial => 0,low_watermark => 0,max_retry_time => 10000,rate => infinity},message_in => #{capacity => 1099511627776,divisible => false,failure_strategy => force,initial => 0,low_watermark => 0,max_retry_time => 10000,rate => infinity},message_routing => #{capacity => 1099511627776,divisible => false,failure_strategy => force,initial => 0,low_watermark => 0,max_retry_time => 10000,rate => infinity}},connection => #{capacity => 1000,initial => 0,rate => 100.0},message_in => #{capacity => 1099511627776,initial => 0,rate => infinity},message_routing => #{capacity => 1099511627776,initial => 0,rate => infinity}},listener => {ssl,default},zone => default}]}}]
2022-09-16T08:33:03.693639+00:00 [error] supervisor: 'esockd_connection_sup - <0.2168.0>', errorContext: connection_shutdown, reason: {ssl_error,{tls_alert,{bad_certificate,"TLS server: In state certify at ssl_handshake.erl:2030 generated SERVER ALERT: Fatal - Bad Certificate\n"}}}, offender: [{pid,<0.2584.0>},{name,connection},{mfargs,{emqx_connection,start_link,[#{enable_authn => true,limiter => #{bytes_in => #{capacity => 1099511627776,initial => 0,rate => infinity},client => #{bytes_in => #{capacity => 1099511627776,divisible => false,failure_strategy => force,initial => 0,low_watermark => 0,max_retry_time => 10000,rate => infinity},connection => #{capacity => 1099511627776,divisible => false,failure_strategy => force,initial => 0,low_watermark => 0,max_retry_time => 10000,rate => infinity},message_in => #{capacity => 1099511627776,divisible => false,failure_strategy => force,initial => 0,low_watermark => 0,max_retry_time => 10000,rate => infinity},message_routing => #{capacity => 1099511627776,divisible => false,failure_strategy => force,initial => 0,low_watermark => 0,max_retry_time => 10000,rate => infinity}},connection => #{capacity => 1000,initial => 0,rate => 100.0},message_in => #{capacity => 1099511627776,initial => 0,rate => infinity},message_routing => #{capacity => 1099511627776,initial => 0,rate => infinity}},listener => {ssl,default},zone => default}]}}]

你这个是证书握手层面的错误。还未到mqtt 报文层面。建议你抓一下握手过程的报文进行分析,或者你把你这套证书拿到其他应用进行验证排除是否是emqx层面导致的