SteamFrame/FrameAssistant
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

TLS for the MQTT connection (iteration 2, step 5)

Browse Source 
ca_file or the system's CAs (MOSQ_OPT_TLS_USE_OS_CERTS), client
certificate, broker certificate and host name verified, settings errors
reported before connecting. The client thread blocks SIGPIPE: with TLS,
a write to a connection the broker closed killed the process. The
reason of a failed handshake (libmosquitto's log) is appended to the
error. tst_mqtt covers TLS with test certificates in tests/data (D44).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
matzman
2026-10-06 16:29:32 +02:00
co-authored by Claude Opus 5.5
parent 943e90c1b1
commit 148ae663cf
14 changed files with 336 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/data/README.md
+29
View File
@@ -0,0 +1,29 @@
# Test certificates
For the TLS cases in `tst_mqtt` (docs/DESIGN.md, D44). EC P-256, valid until 2126. Test use
only: the private keys are public.
| File | What |
|---|---|
| `ca.crt` | Test CA (its key was deleted after signing) |
| `server.crt`, `server.key` | Broker certificate from the test CA, for `localhost` and `127.0.0.1` |
| `client.crt`, `client.key` | Client certificate from the test CA |
| `other-ca.crt` | A second CA that signed nothing here: the wrong CA |
Made with:
```sh
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
-keyout ca.key -out ca.crt -days 36500 -subj "/CN=FrameAssistant test CA"
openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
-keyout server.key -out server.csr -subj "/CN=localhost"
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt \
-days 36500 -extfile <(printf "subjectAltName=DNS:localhost,IP:127.0.0.1\nextendedKeyUsage=serverAuth")
openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
-keyout client.key -out client.csr -subj "/CN=frameassistant-test-client"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt \
-days 36500 -extfile <(printf "extendedKeyUsage=clientAuth")
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
-keyout other-ca.key -out other-ca.crt -days 36500 -subj "/CN=Other test CA"
rm server.csr client.csr ca.srl ca.key other-ca.key
```