如何从ACM获取客户端证书？NLB与MQTT客户端安全连接求助

Got it, let's walk through exactly what you need to do to secure your Python MQTT connection to your NLB. First, a quick clarification: since you've set up your NLB with an ACM certificate on port 8883, you likely need a CA certificate chain to let your Python client trust the NLB's TLS certificate (this is standard one-way TLS authentication). If you later need mutual TLS (where the NLB also verifies your client's identity), I'll cover that too.

Step 1: Download the ACM Certificate Chain #

Your Python client needs the certificate chain associated with the ACM certificate you bound to your NLB's 8883 listener. This chain tells the client that the NLB's certificate is issued by a trusted authority.

Option 1: AWS Console #

• Log into the AWS Management Console and navigate to the ACM (AWS Certificate Manager) service.
• Find the certificate you're using for the NLB 8883 listener (you can filter by status or domain name).
• Select the certificate, then click Download in the "Certificate details" section.
• Choose the Certificate chain option and save it as a .pem file (e.g., ca_chain.pem) on the machine running your Python script.

Option 2: AWS CLI #

If you prefer command line, run this (replace <YOUR_CERTIFICATE_ARN> with your certificate's ARN):

aws acm get-certificate --certificate-arn <YOUR_CERTIFICATE_ARN> --query 'CertificateChain' --output text > ca_chain.pem

Step 2: Update Your Python MQTT Script #

Assuming you're using the popular paho-mqtt library (the most common choice for Python MQTT), here's how to modify your script to use the certificate chain:

import paho.mqtt.client as mqtt

# Callback for when the client connects to the broker
def on_connect(client, userdata, flags, rc):
    print(f"Connected successfully with result code: {rc}")
    # Subscribe to your desired topic(s) here
    client.subscribe("your/topic/here")

# Callback for when a message is received
def on_message(client, userdata, msg):
    print(f"Received message on {msg.topic}: {msg.payload.decode()}")

# Initialize the MQTT client
client = mqtt.Client()

# Configure TLS using the downloaded certificate chain
client.tls_set(ca_certs="ca_chain.pem")

# Connect to your NLB's DNS name on port 8883
client.connect("your-nlb-dns-name-here", 8883, keepalive=60)

# Attach callbacks
client.on_connect = on_connect
client.on_message = on_message

# Start the client loop to process messages
client.loop_forever()

Key Notes for This Setup: #

• You don't need a separate "client certificate" for one-way TLS (this is the standard setup where only the server/NLB presents a certificate to the client).
• Make sure the path to ca_chain.pem is correct relative to your script, or use an absolute path.
• Verify that your Python environment can reach the NLB's 8883 port (check security groups and network ACLs if you run into connection issues).

If You Need Mutual TLS (NLB Verifies Client Identity) #

If you want to enforce that only clients with a valid certificate can connect (mutual TLS), you'll need to:

1. Create or import a client certificate in ACM (or use a third-party CA).
2. Update your NLB's 8883 listener to enable client certificate verification, specifying the CA that issued your client certificates.
3. Download the client certificate (.pem) and private key (.pem) from ACM.
4. Modify your Python script to include these files in the tls_set call:

   client.tls_set(
       ca_certs="ca_chain.pem",
       certfile="client_certificate.pem",
       keyfile="client_private_key.pem"
   )
   

That's all you need to get your secure MQTT connection up and running with the NLB!

内容的提问来源于stack exchange，提问作者Akshay Jindal