市面上有相當(dāng)多的高質(zhì)量MQTT代理，mosquitto是一個(gè)開源的輕量級的C實(shí)現(xiàn)，完全兼容MQTT 3.1和MQTT 3.1.1，配合mosquitto_pub和mosquitto_sub命令行工具，是一個(gè)比較適合MQTT入門的工具。
本文以mosquitto為例搭建MQTT服務(wù)，測試環(huán)境是阿里云（mqtt.youyangiot.com：47.94.221.244）和本地（192.168.100.101）Ubuntu 16.04.4 LTS系統(tǒng)。
1. 安裝和使用
安裝mosquitto及mosquitto-clients
sudo apt-get install software-properties-common python-software-properties
sudo apt-add-repository ppa:mosquitto-dev/mosquitto-ppa
sudo apt-get update
sudo apt-get install mosquitto
sudo apt-get install mosquitto-clients
測試訂閱
mosquitto_sub -h 47.94.221.244 -d -t 'room-A/temperature'
測試發(fā)送
mosquitto_pub -h 47.94.221.244 -d -t 'room-A/temperature' -m '{"time":"1509289143197","code":0,"id":"09df1610-3bfb-4eab-a461-26e83962b10a","temp":25}'
2. SSL/TLS加密
MQTT是基于TCP的，默認(rèn)情況通訊并不加密。如果需要傳輸敏感信息或者對設(shè)備進(jìn)行反控，使用SSL/TLS幾乎是必須的。
注意：在填寫FQDN（Fully Qualified Domain Name）字段的時(shí)候最好用服務(wù)器域名，本文中使用mqtt.youyangiot.com。
生成CA證書和密鑰
openssl req -new -x509 -days 365 -extensions v3_ca -keyout ca.key -out ca.crt
生成MQTT代理服務(wù)器的密鑰
openssl genrsa -out server.key 2048
生成MQTT代理服務(wù)器的CSR（Certificate Signing Request）
openssl req -out server.csr -key server.key -new
通過CA簽署CSR，生成MQTT代理證書
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365
配置/etc/mosquitto/mosquitto.conf，啟用SSL/TLS
listener 8883
protocol mqtt
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
重啟mosquitto服務(wù)
sudo service mosquitto stop
sudo service mosquitto start
測試訂閱
mosquitto_sub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' --cafile ./ca.crt
測試發(fā)送
mosquitto_pub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' -m '{"time":"1509289143197","code":0,"id":"09df1610-3bfb-4eab-a461-26e83962b10a","temp":25}' --cafile ./ca.crt
3. 客戶端X509證書認(rèn)證
MQTT代理在TLS握手成功之后可以繼續(xù)發(fā)送客戶端的X509證書來認(rèn)證設(shè)備，如果設(shè)備不合法便可以中斷連接，代價(jià)是需要有較好的證書創(chuàng)建流程和證書的管理系統(tǒng)。
生成MQTT設(shè)備的密鑰
openssl genrsa -out client.key 2048
生成MQTT設(shè)備的CSR（Certificate Signing Request）
openssl req -out client.csr -key client.key -new
通過CA簽署CSR，生成MQTT設(shè)備證書
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 365
配置/etc/mosquitto/mosquitto.conf，啟用SSL/TLS
listener 8883
protocol mqtt
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
require_certificate true
重啟mosquitto服務(wù)
sudo service mosquitto stop
sudo service mosquitto start
測試訂閱
mosquitto_sub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' --cafile ./ca.crt --cert client.crt --key client.key
測試發(fā)送
mosquitto_pub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' -m '{"time":"1509289143197","code":0,"id":"09df1610-3bfb-4eab-a461-26e83962b10a","temp":25}' --cafile ./ca.crt --cert client.crt --key client.key
4. 客戶端用戶名密碼認(rèn)證
Mosquitto支持用戶名/密碼認(rèn)證方式，使用起來非常方便，不過由于用戶名密碼是以明文形式傳輸，最好配合SSL/TSL加密使用。
生成用戶名和密碼文件
cd /etc/mosquitto
sudo mosquitto_passwd -c passwd test
配置/etc/mosquitto/mosquitto.conf，啟用SSL/TLS
listener 8883
protocol mqtt
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
password_file /etc/mosquitto/passwd
allow_anonymous false
重啟mosquitto服務(wù)
sudo service mosquitto stop
sudo service mosquitto start
測試訂閱
mosquitto_sub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' --cafile ./ca.crt -u test -P 123456
測試發(fā)送
mosquitto_pub -h mqtt.youyangiot.com -p 8883 -d -t 'room-A/temperature' -m '{"time":"1509289143197","code":0,"id":"09df1610-3bfb-4eab-a461-26e83962b10a","temp":25}' --cafile ./ca.crt -u test -P 123456
5. WebSocket支持
Mosquitto支持WebSocket的調(diào)用方式，為HTML類型的應(yīng)用提供非常便利的方式。
配置/etc/mosquitto/mosquitto.conf，啟用WebSocket
listener 8080
protocol websockets
如果要啟用SSL/TLS WebSocket
listener 8081
protocol websockets
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
重啟mosquitto服務(wù)
sudo service mosquitto stop
sudo service mosquitto start
JS在線客戶端測試 paho JS client
python客戶端WebSocket適配代碼
client = mqtt.Client(transport='websockets')
client.connect(mqtt.youyangiot.com, 8080, 60)
參考文章
Eclipse Mosquitto - An open source MQTT broker
Eclipse Paho
MQTT入門篇
