如何为已配置SSL的MQTT Mosquitto启用TPM证书存储引擎

Hey there! Great news—yes, you can absolutely use a TPM (Trusted Platform Module) engine to store your SSL certificates with Mosquitto and maintain secure connections with your MQTT clients. Let’s break down how to set this up, building on the Mosquitto config documentation you referenced.

Prerequisites First #

Before diving in, make sure you have these boxes checked:

• A TPM 2.0 module enabled and accessible on your system (verify with tpm2_pcrread from the tpm2-tools package)
• Mosquitto version 1.6 or newer (TPM engine support was added around this release)
• OpenSSL with TPM engine support compiled in (confirm with openssl engine -t—look for tpm2 in the list of available engines)

Step-by-Step Mosquitto Configuration #

Instead of pointing directly to cafile, certfile, and keyfile in your mosquitto.conf, you’ll leverage OpenSSL’s TPM engine to pull certificates/keys from the module. Here’s how to set it up:

1. Enable the TPM Engine in Mosquitto
   First, tell Mosquitto to use the TPM engine. Add these lines to your mosquitto.conf:

   # Enable OpenSSL TPM engine
   ssl_engine tpm2
   
   # Specify the path to the TPM engine library (adjust path for your distro)
   ssl_engine_options SO_PATH=/usr/lib/x86_64-linux-gnu/engines-3/tpm2.so,ID=tpm2
   

   Pro tip: Use find /usr/lib -name tpm2.so to locate the exact path to the engine library on your system.

2. Reference TPM-Stored Certificates/Keys
   Replace your existing certfile and keyfile lines with references to the TPM’s persistent handles (these are the IDs you assigned when importing assets into the TPM):

   # CA certificate (can stay as a file or be stored in TPM too)
   cafile /etc/mosquitto/ca.crt
   
   # Server certificate pulled from TPM (use your persistent handle)
   ssl_certificate tpm2:handle=0x81000001
   
   # Server private key pulled from TPM (use your persistent handle)
   ssl_private_key tpm2:handle=0x81000002
   

   Use tpm2_listpersistent to view all persistent assets stored in your TPM and their handles.

3. Validate the Configuration
   Test your updated config to make sure everything loads correctly:

   mosquitto -c /etc/mosquitto/mosquitto.conf -v
   

   Look for a log line like Loaded OpenSSL tpm2 engine—that confirms the engine was loaded successfully.

Client Connection Tips #

When connecting with MQTT.FX (or any other MQTT client), the process is nearly identical to your previous SSL setup:

• The client still needs your CA certificate (ca.crt) to trust the server
• No changes are required on the client side for the TPM integration— the server’s SSL handshake will use the TPM-stored certificate transparently

Key Things to Keep in Mind #

• Backup your assets: Always make backups of your certificate and private key before importing them into the TPM—recovering data from a failed TPM can be extremely difficult.
• Permissions: Ensure the mosquitto user has access to the TPM device (usually /dev/tpmrm0 or /dev/tpm0). Add them to the tss group with usermod -aG tss mosquitto to grant access.
• TPM Version: Stick to TPM 2.0—older TPM 1.2 modules have limited support with modern Mosquitto and OpenSSL versions.

If you run into issues with specific commands or handle values, feel free to share details and I can help troubleshoot further!

内容的提问来源于stack exchange，提问作者Anup