无法获取到TLS信息、使用证书信息作为用户名/ClientID无效

错误报告

环境

  • EMQX 版本:5.0.11
  • 操作系统版本:Docker(emqx/emqx:latest)

重现此问题的步骤

配置文件如下(该配置文件映射到了容器中/opt/emqx/data/configs/local-override.conf):

node.cookie = "xxx"

mqtt.peer_cert_as_username = pem
mqtt.peer_cert_as_clientid = cn

listeners.ssl.default.ssl_options {
  keyfile = "etc/certs/server.key"
  certfile = "etc/certs/server.crt"
  cacertfile = "etc/certs/ca.crt"
}

listeners.wss.default.ssl_options {
  keyfile = "etc/certs/server.key"
  certfile = "etc/certs/server.crt"
  cacertfile = "etc/certs/ca.crt"
}

dashboard {
    default_username = "xxx"
    default_password = "123456"
    listeners.http.enable = false
    listeners.https {
        enable = true
        keyfile = "etc/certs/server.key"
        certfile = "etc/certs/server.crt"
        cacertfile = "etc/certs/ca.crt"
    }
}

authentication {
    mechanism = password_based
    backend = http
    enable = true

    method = post
    url = "http://192.168.110.191:8082/authentication/${clientid}"
    body {
        host = "${peerhost}"
        cert = "${cert_common_name}"
        subject = "${cert_subject}"
        username = "${username}"
        password = "${password}"
    }
    headers {
        "Content-Type" = "application/json"
        "X-Request-Source" = "EMQX"
    }
}

authorization {
  deny_action = ignore
  no_match = deny
  sources =  [
    {
      type = http
      method = post
      url = "http://192.168.110.191:8082/authorization/${clientid}"
      body {
        host = "${peerhost}"
        topic = "${topic}"
        action = "${action}"
      }
      headers {
          "Content-Type" = "application/json"
          "X-Request-Source" = "EMQX"
      }
    }
  ]
}

容器的DockerCompose:

emqx:
    image: emqx/emqx:latest
    container_name: ${PROJECT_NAME}-emqx
    user: "${UID}:${GID}"
    expose:
      - 1883
      - 8081
    ports:
      - "${EMQX_PORT_8883}:8883"
      - "${EMQX_PORT_18084}:18084"
      - "${EMQX_PORT_8084}:8084"
    volumes:
      - "/etc/passwd:/etc/passwd"
      - "/etc/group:/etc/group"
      - "./emqx/data:/opt/emqx/data"
      - "./emqx/emqx.conf:/opt/emqx/data/configs/local-override.conf"
      - "./emqx/certs:/opt/emqx/etc/certs"
      - "./emqx/log:/opt/emqx/log"
    env_file:
      - env/emqx.env

其中环境变量文件是空的

启动后配置也已经生效:



但是认证时却得不到参数信息,用户名和ClientID也是原来的用户名和ClientID:

日志也没有报错信息

预期行为

实际行为


功能请求

描述你需要的功能

为什么你需要这个功能


其他

你是使用的双向认证吗?

我不太确定我是否使用了双向认证,但是客户端我是把ca证书和客户端证书还有密钥都设置了的。以上是emqx的所有配置,客户端连接是这样的:

双向认证的话你还需要在 EMQX 这边配置:

listeners.ssl.default.ssl_options {
  verify  =  verify_peer
  fail_if_no_peer_cert = true
}

非常感谢,加上这个配置之后就可以了