How to reference a common name inside a client certification in server.Events?

[YamazakiYasuhiro]

Dear, great developers!

This product is extremely clean and neat code, also easy to understand. Thank all of the developers for your effort.

I've looked around some documents and tested this product. And after reading almost the code of this product, I could not find how to access a common name in the certificate at server.Events callbacks.

Currently, I've created a management system of IoT devices using AWS IoT and I would like to move all to a self-managed MQTT server from AWS. Looks Mochi MQTT server is the best for my purpose.

The current devices use the TLS and provide the client certificates for each device to be identified what devices are accessed. I know MQTT defines other authentication methods on the layer itself, however, we wanted to manage all devices by the certificates.

Now I'm looking around EstablishFunc placed after TLS connection. Around this place, search the common name in the certificate from a white list in memory, if it is not there, then drop it.
If you have a hint to find a better place to add the feature, could you tell me that?
Thank you.

[torntrousers]

How about instead of trying to do it in the EstablishFunc set up a VerifyPeerCertificate function on the Server's TLSConfig?

tlsConfig := &tls.Config{
  . . .
		VerifyPeerCertificate:  <your.function>,
	}

Also, I'd be really interested in hearing about the reasons that helped you to decide to spin your own solution intsead of using AWS IoT? Either here or could I contact you off list?

[YamazakiYasuhiro]

Thank you for your reply! I'll try your solution candidate and report the result later.

AWS IoT is still a great platform to launch MQTT servers quickly, and another advantage of AWS IoT is a managed service. I could get a result of what I want to do. AWS IoT is an entrance of the data. It means all things should depend on other AWS services. Lambda, DynamoDB, and Awww, yeah, many other services are required. Each service is tiny, but assembling all services is too much for me as a system. I want the system to become smaller and simpler. I want to add other features and restart the system quickly. golang generates a single binary and becomes it easy to install. Just compiling, running, and testing is very handy for me. Mochi MQTT Server is the best for this philosophy. The serverless like AWS IoT is the best solution for me in the early phase to confirm the sort of feasibility.

[YamazakiYasuhiro]

it greatly works fine! thank you very much!

func verify(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
	for _, asn1Data := range rawCerts {
		cert, err := x509.ParseCertificate(asn1Data)
		if err != nil {
			fmt.Println("failed to parse certificate: " + err.Error())
			return err
		}
		fmt.Println("Public Key: ")
		fmt.Println(x509.MarshalPKIXPublicKey(cert.PublicKey))
		fmt.Println("Subject: ")
		fmt.Println(cert.Subject)
	}
	return nil
}

[RangelReale]

@YamazakiYasuhiro I'm also looking for emulating AWS IOT core locally, mainly for testing, did you get far on this, is it viable?

[YamazakiYasuhiro]

@RangelReale If you want to test MQTT with other compatible AWS features, the answer is no. AWS IoT Core has a bunch of features and Web APIs. My implementation is independent of these. Only a test of simple connectivity of MQTT would work fine.

[RangelReale]

looks like it is also available in conn.ConnectionState().PeerCertificates. Do we have access to the conn object?

https://stackoverflow.com/a/64402683/784175

[mochi-co]

@RangelReale Client.Net.conn is currently not exported, but I can change it to be exported if that would be beneficial for everyone. Let me know what you think 👍🏻

[mochi-co]

@RangelReale Client.Net.Conn is now exported as of v2.1.3 - let me know if this helps

[RangelReale]

just tested, I am able to get the same certificate as the one in the VerifyPeerCertificate method. Thanks!

func (h *AuthHook) OnConnectAuthenticate(cl *mqtt.Client, pk packets.Packet) bool {
	if tlsConn, ok := cl.Net.Conn.(*tls.Conn); ok {
		for _, cert := range tlsConn.ConnectionState().PeerCertificates {
			fmt.Println("Public Key: ")
			fmt.Println(x509.MarshalPKIXPublicKey(cert.PublicKey))
			fmt.Println("Subject: ")
			fmt.Println(cert.Subject)
		}
	}
	return true
}