MQTT Binding and SSL
Purpose
Until the MQTT binding 2.0 comes along, we have to do with the 1.9 version. Unfortunately this binding, despite having the ssl option is not able to implement it. I will show how to create your own ssl certificate and key, how to use keytool to create a keystore and a truststore for private and public keys for Java and finally how to modify the OpenHAB configuration to load these keys to enable ssl.Prerequisites
- The MQTT Binding is installed and running
- openHAB is running on a Linux based operating system (This is because I have no idea if openssl and keytool are available under Windows)
Configuration
Create the Java jsk keystore
This information was from:
In your /etc folder, in the console enter the following command:
If you choose to use another folder make sure to use the same one for the rest
of the tutorial.
sudo keytool -genkeypair -alias myopenhab -keyalg RSA -keystore keystore.jks
You can replace the alias and the filename with other values
but keep a note as we will need them later.
You will be asked for a password at the start. Make note of it.
you will prompted for information (for example):
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:New York
Locality Name (eg, city) []:Brooklyn
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example Brooklyn Company
Organizational Unit Name (eg, section) []:Technology Division
Common Name (e.g. server FQDN or YOUR name) []:examplebrooklyn.com
Email Address []:
You can enter dummy values, they donāt really matter.
Press enter when asked for the second password.
you should now have a file keystore.jks in your /etc folder.
Create the Java jsk truststore
This information was obtained from:
http://peoplesofttutorial.com/generating-key-store-and-trust-store-using-keytool/
In order to create the Java truststore, you will need the public certificate
of your MQTT broker.
In my case, as I am using cloudMQTT, the public certificate is available for download
at: CONTACT US - Comodo: Cloud Native Cyber Security Platform
Internally, behind my firewall and reverse proxy, I am using a mosquitto broker
without SSL.
I needed to use a public broker for use with Owntracks as my mobile
(cellular) network provider doesnāt allow connection to my home server
on ports like 1883 or 8883. Go figure 
Once you have obtained the public certificate of your MQTT broker as
a *.cert file (CloudMQTT file is addtrustexternalroot.cert), you need
to wrap it in a Java truststore.
Make sure that your certificate file is in your /etc folder.
Again, in the console in your /etc folder enter the following:
sudo keytool -import -alias myopenhab -file addtrustexternalroot.cert -storetype JKS -keystore.jsk
You will be asked for a password at the start. Make note of it.
Again, you can replace the alias and truststore.jsk file names with your
own values but make note of them. Replace addtrustexternalroot.cert with
the file name of the public certificate you obtained from your MQTT broker.
Check and verify
In your **/etc** folder you should now have:- keystore.jks (keystore_password)
- publicCA.cert
- truststore.jks (truststore_password)
Modify OpenHAB environment
This is taken from:In you console enter the following:
cd /usr/share/openhab2/runtime/bin
sudo nano setenv
scroll down and locate the section starting with:
export JAVA_OPTS=ā${JAVA_OPTS}ā
Add the following lines to the list:
-Dcom.ibm.ssl.trustManager=SunX509
-Dcom.ibm.ssl.keyManager=SunX509
-Dcom.ibm.ssl.contextProvider=SunJSSE
-Dcom.ibm.ssl.keyStore=/etc/keystore.jks
-Dcom.ibm.ssl.keyStorePassword=keystore_password
-Dcom.ibm.ssl.keyStoreType=JKS
-Dcom.ibm.ssl.keyStoreProvider=SUN
-Dcom.ibm.ssl.trustStore=/etc/truststore.jks
-Dcom.ibm.ssl.trustStorePassword=truststore_password
-Dcom.ibm.ssl.trustStoreType=JKS
-Dcom.ibm.ssl.trustStoreProvider=SUN
exit nano and save
restart openhab
sudo systemctl restart openhab2.service
Configure your MQTT binding
In your service folder edit the mqtt.cfg file
In my case my MQTT broker is:
cloudmqtt.url=ssl://m23.cloudmqtt.com:24879
cloudmqtt.clientId:openhab2
cloudmqtt.user=username
cloudmqtt.pwd=password
If everything went allright, you should now be connected to a
MQTT broker via SSL!!
But what I can see happening is that as IoT gets more and more prevalent and more people set up some sort of automation hub, it will attract the bad element. Theyāll do it because they can and because they will try to extract some kind of ransom to liberate our automation hubs.