EC2 の Amazon Linux 2 インスタンスに Mosquitto をインストールして SSL/TLS 認証を設定する

$ sudo amazon-linux-extras install epel
$ sudo yum install mosquitto -y

$ sudo systemctl start mosquitto
$ sudo systemctl enable mosquitto

$ sudo systemctl status mosquitto
● mosquitto.service - Mosquitto MQTT v3.1/v3.1.1 Broker
   Loaded: loaded (/usr/lib/systemd/system/mosquitto.service; enabled; vendor preset: disabled)
   Active: active (running) since Wed 2020-08-26 16:38:06 JST; 1 day 18h ago
     Docs: man:mosquitto.conf(5)
           man:mosquitto(8)
 Main PID: 18791 (mosquitto)
   CGroup: /system.slice/mosquitto.service
           └─18791 /usr/sbin/mosquitto -c /etc/mosquitto/mosquitto.conf
Hint: Some lines were ellipsized, use -l to show in full.

$ mosquitto_sub -t hoge -h localhost

$ mosquitto_pub -t hoge -h localhost -m "Hello, world"

Hello, world

$ sudo openssl genrsa -des3 -out ca.key 2048
Generating RSA private key, 2048 bit long modulus
................................................+++
.............................+++
e is 65537 (0x10001)
Enter pass phrase for ca.key:パスフレーズ
Verifying - Enter pass phrase for ca.key:パスフレーズ

$ sudo openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
Enter pass phrase for ca.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:myca
Email Address []:

$ sudo openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
........................................................................................+++
........+++
e is 65537 (0x10001)

$ sudo openssl req -new -out server.csr -key server.key
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:都道府県
Locality Name (eg, city) [Default City]:市町村
Organization Name (eg, company) [Default Company Ltd]:組織名
Organizational Unit Name (eg, section) []:部署名
Common Name (eg, your name or your server's hostname) []:ホスト名 (サーバーの FQDN など)
Email Address []:メールアドレス

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:<なし>
An optional company name []:<なし>

$ sudo openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 3650
Signature ok
subject=/C=JP/ST=都道府県/L=市町村/O=組織名/OU=部署/CN=ホスト名/emailAddress=メールアドレス
Getting CA Private Key
Enter pass phrase for ca.key:CA秘密鍵のパスフレーズ

$ cd /etc/mosquitto/
$ sudo mkdir certs
$ sudo cp ~/server.{crt,key} ca.crt ./certs/
$ sudo chmod 400 ./certs/server.key
$ sudo chmod 444 ./certs/ca.crt
$ sudo chmod 444 ./certs/server.crt
$ ls -l /etc/mosquitto/certs/
total 12
-r--r--r-- 1 root root 1424 Aug 25 19:10 ca.crt
-r--r--r-- 1 root root 1306 Aug 25 19:09 server.crt
-r-------- 1 root root 1679 Aug 25 19:09 server.key

-#port 1883
+port 8883

# "openssl rehash <path to capath>" each time you add/remove a certificate.
-#cafile
+cafile /etc/mosquitto/certs/ca.crt

# Path to the PEM encoded server certificate.
-#certfile
+certfile /etc/mosquitto/certs/server.crt

# Path to the PEM encoded keyfile.
-#keyfile
+keyfile /etc/mosquitto/certs/server.key

$ sudo systemctl restart mosquitto

$ tail -f /var/log/mosquitto/mosquitto.log
mosquitto[17422]: 1598417779: mosquitto version 1.6.10 starting
mosquitto[17422]: 1598417779: Config loaded from /etc/mosquitto/mosquitto.conf.
mosquitto[17422]: 1598417779: Opening ipv4 listen socket on port 8883.
mosquitto[17422]: 1598417779: Opening ipv6 listen socket on port 8883.
systemd[1]: Started Mosquitto MQTT v3.1/v3.1.1 Broker.

$ sudo mosquitto_passwd -c /etc/mosquitto/mqttpass ユーザー名
Password: 
Reenter password: 

$ cat /etc/mosquitto/mqttpass 
ユーザー名:$6$7Y/7oiQLgaDcU53W$+pMc7mdqxO8JRlGEWw5qWY9iVXt4KkSYxauKvniEL87KT+2DS9HhivxuY5MEmxo80O22YYCb/E01NjbqpCNVfg==

-#allow_anonymous true
+allow_anonymous false

-#password_file
+password_file /etc/mosquitto/mqttpass

$ sudo systemctl restart mosquitto

$ mosquitto_sub -t hoge -h ホスト名 -p 8883 --cafile /etc/mosquitto/certs/ca.crt -u ユーザー名 -P パスワード

$ mosquitto_pub -t hoge -m "Hello, encrypted world" -h ホスト名 -p 8883 --cafile /etc/mosquitto/certs/ca.crt -u ユーザー名 -P パスワード

Hello, encrypted world