CODEWITHSUNDEEP
sslmqtt
Random Forkson
Random Forkson

Reputation: 71

How does one way SSL work in MQTT?

I wanted to implement One Way SSL in MQTT. From what I researched, in on way SSL, the client has a stored default cert. It will use this initially stored cert and compared it with the cert from the broker side. If the cert is valid, then they established a secured connection. However, our embedded software engineer says that the client side doesn't need cert, it will just have to get the cert from the broker side then it will use for a secured connection. To summarized, what I understand is the client has a stored cert, and it will compare it with the one the broker has. The engineer says the client doesn't a stored cert, it will just get one from broker.

He already tested it by connecting to our broker with any initially stored cert and it really worked. Now I don't understand how one way SSL really works.

Upvotes: 1

Views: 974

Answers (1)

hardillb
hardillb

Reputation: 59791

SSL with MQTT works as it does with any other protocol.

There are 2* main modes

  1. Server (broker) only authentication. In this case the client connects to the server (broker), the broker sends it's certificate to the client. The client checks the certificate is issued (signed) by somebody the client trusts, this proves the server (broker) is who it claims to be and can be trusted. The client and server (broker) then do key negotiation in order to set up an encrypted tunnel. The act of checking that the server certificate is issued by a trusted party is to check it is signed by a known CA (certificate authority) certificate, this means the client needs to keep a list of trusted certificates.

  2. Mutual authentication of both client and server (broker). This is pretty much the same as before except the client also sends it's own unique certificate to the server (broker) this is also checked to see that it is issued by a known CA and the CN field is used as the user id of the client.

*There is also pre-shared keys mode which don't use certificates at all.

Upvotes: 3

Related Questions