Generate a CA certificate and register it with an ApsaraMQ for MQTT broker - ApsaraMQ for MQTT

ApsaraMQ for MQTT uses CA certificates to verify device certificates during client authentication. You must register a CA certificate with the ApsaraMQ for MQTT broker before it can be used for verification.

Background information

When a client authenticates with a device certificate, the broker uses the associated CA certificate to verify its validity. Register the CA certificate with an ApsaraMQ for MQTT broker before using it for verification.

To register a CA certificate, upload it to the ApsaraMQ for MQTT broker and bind it to an instance. The relationship between instances and CA certificates:

Multiple CA certificates can be registered with an instance.
Within a region, a CA certificate can be registered with only one instance.

Limitations

Only Enterprise Platinum Edition instances and Professional Edition instances support CA certificate management.
The serial number of your CA certificate must be unique.
The serial number of a CA certificate cannot exceed 128 bytes.
CA certificates support Rivest-Shamir-Adleman (RSA) and Elliptic Curve Cryptography (ECC) algorithms.

Prerequisites

You have installed OpenSSL v1.1.1i or later.

Create a self-signed CA certificate

You can purchase a CA certificate from a trusted certificate authority (CA) or generate a self-signed one. The following procedure uses OpenSSL to generate a self-signed CA certificate.

Download and install OpenSSL

Download and install OpenSSL.

Note
After the installation is complete, if you use Windows, add the bin subdirectory of the OpenSSL installation directory to your system's PATH environment variable.
Open Command Prompt.

RSA certificate

Run the following command to generate a private key for the RSA CA certificate:
```
openssl genrsa -out CA.key 2048
```

Run the following command to create a CSR file by using the CA certificate's private key:

openssl req -new -key CA.key -out CA.csr

The following output is displayed. Enter the required parameter values based on the prompts.

Country Name (2 letter code) [AU]:
    State or Province Name (full name) []:
    Locality Name (for example, city) []:
    Organization Name (for example, company) []:
    Organizational Unit Name (for example, section) []:
    Common Name (e.g. server FQDN or YOUR name) []:
    Email Address []:

Run one of the following commands based on your operating system to generate a self-signed RSA CA certificate named CA.crt. The location of the extfile varies based on the operating system.

macOS

openssl x509 -req -extfile /System/Library/OpenSSL/openssl.cnf -extensions v3_ca -in CA.csr -out CA.crt -signkey CA.key -CAcreateserial -days 3650

CentOS

openssl x509 -req -extfile /etc/pki/tls/openssl.cnf -extensions v3_ca -in CA.csr -out CA.crt -signkey CA.key -CAcreateserial -days 3650

Windows

openssl x509 -req -extfile C:\Progra~1\OpenSSL-Win64\bin\cnf\openssl.cnf  -extensions v3_ca -in CA.csr -out CA.crt -signkey CA.key -CAcreateserial -days 3650

View the generated RSA CA certificate.
Run the following command:
```
openssl x509 -in CA.crt -text
```

ECC certificate

Run the following command to generate a private key for the ECC CA certificate:
```
openssl ecparam -genkey -name prime256v1 -out CA.key
```

Generate a self-signed ECC CA certificate named CA.crt.

macOS

openssl req -new -x509 -days 3650 -config /System/Library/OpenSSL/openssl.cnf -extensions v3_ca -key CA.key -out CA.crt

CentOS

openssl req -new -x509 -days 3650 -config /etc/pki/tls/openssl.cnf -extensions v3_ca -key CA.key -out CA.crt

Windows

openssl req -new -x509 -days 3650 -config C:\Progra~1\OpenSSL-Win64\bin\cnf\openssl.cnf -extensions v3_ca -key CA.key -out CA.crt

Note

If an error occurs, verify that the openssl.cnf file path in the command is correct.

The following output is displayed. Enter the required parameter values based on the prompts.

    Country Name (2 letter code) [AU]:
    State or Province Name (full name) []:
    Locality Name (for example, city) []:
    Organization Name (for example, company) []:
    Organizational Unit Name (for example, section) []:
    Common Name (e.g. server FQDN or YOUR name) []:
    Email Address []:

Run the following command to view the generated ECC CA certificate:
```
openssl x509 -in CA.crt -text
```

Register a CA certificate

Note

After a CA certificate is registered, it is activated by default.

Obtain the registration code for the CA certificate.
1. Log on to the ApsaraMQ for MQTT console. In the left-side navigation pane, click Instances.
2. In the top navigation bar, select the region where your instance is deployed. On the Instances page, click the name of your instance. The Instance Details page appears. In the left-side navigation pane, choose Certificate Management > CA Certificate.
3. On the CA Certificate page, click Register Certificate.
  
  In the Register CA Certificate dialog box, copy the Registration Code by clicking Copy Registration Code. Then, upload the validation certificate and the CA certificate by clicking Upload Validation Certificate and Upload CA Certificate.
Create a validation certificate for the CA certificate.

To register a CA certificate with the ApsaraMQ for MQTT broker, you must prove ownership of its private key by creating a validation certificate signed with that key. The validation certificate must contain the registration code provided by ApsaraMQ for MQTT.
RSA certificate
1. Run the following command to generate a private key for the validation certificate:
```
openssl genrsa -out verificationCert.key 2048
```
2. Run the following command to create a CSR file for the validation certificate:
```
openssl req -new -key verificationCert.key -out verificationCert.csr
```
  The following output is displayed. Enter the required parameter values based on the prompts.
```
Country Name (2 letter code) [AU]:
    State or Province Name (full name) []:
    Locality Name (for example, city) []:
    Organization Name (for example, company) []:
    Organizational Unit Name (for example, section) []:
    Common Name (e.g. server FQDN or YOUR name) []:i29adsjfp29jfj92jlajsdf******
    Email Address []:
```
  Important
  You must specify the CommonName parameter. Replace the value with the registration code that you obtained in Step 1. Other parameters are optional.
3. Run the following command to generate a validation certificate named verificationCert.crt for the CA certificate:
```
openssl x509 -req -in verificationCert.csr -CA CA.crt -CAkey CA.key -CAcreateserial -out verificationCert.crt -days 300 -sha512
```
  Note
  If you are not using a self-signed CA, submit the generated CSR file to your certificate authority to have them issue the certificate.
ECC certificate
1. Run the following command to generate a private key for the validation certificate:
```
openssl ecparam -out verificationCert.key -name prime256v1 -genkey
```
2. Run the following command to create a CSR file for the validation certificate:
```
openssl req -new -key verificationCert.key -out verificationCert.csr
```
  The following output is displayed. Enter the required parameter values based on the prompts.
```
Country Name (2 letter code) [AU]:
    State or Province Name (full name) []:
    Locality Name (for example, city) []:
    Organization Name (for example, company) []:
    Organizational Unit Name (for example, section) []:
    Common Name (e.g. server FQDN or YOUR name) []:i29adsjfp29jfj92jlajsdf******
    Email Address []:
```
  Important
  You must specify the CommonName parameter. Replace the value with the registration code that you obtained in Step 1. Other parameters are optional.
3. Run the following command to generate a validation certificate named verificationCert.crt for the CA certificate:
```
openssl x509 -req -in verificationCert.csr -CA CA.crt -CAkey CA.key -CAcreateserial -out verificationCert.crt -days 300 -sha512
```
  Note
  If you are not using a self-signed CA, submit the generated CSR file to your certificate authority to have them issue the certificate.
Upload the CA certificate CA.crt and the validation certificate verificationCert.crt.
1. On the CA Certificate page, click Register Certificate.
2. In the Register CA Certificate dialog box, click Upload Validation Certificate and Upload CA Certificate to upload the validation certificate and the CA certificate, and then click OK.

Download a CA certificate

Download a CA certificate to your local computer for backup or to view its details.

In the CA certificate list, find the CA certificate that you want to download and click Download in the Actions column.

Query CA certificates

Query all CA certificates

The CA Certificate page lists all CA certificates registered with the instance.

Query a specific CA certificate

In the search box above the CA certificate list, enter the serial number of a CA certificate and click Search.

Query issued device certificates

In the CA certificate list, find the CA certificate that you want to manage and click Device Certificate in the Actions column.

The Device Certificate page opens, displaying all registered device certificates issued by that CA certificate.

Activate or deregister a CA certificate

CA certificate statuses include Activate and Inactivated. By default, a CA certificate is Activate after registration.

Important

Deregistering a CA certificate also deregisters all device certificates issued by it. Similarly, activating a CA certificate also activates all device certificates issued by it.

Deregister an Activate certificate to make it temporarily unavailable for authentication.
Activate an Inactivated certificate to restore its use.

In the CA certificate list, find the CA certificate that you want to manage and click Deregister or Activate in the Actions column.

Delete a CA certificate

Important

Deleting a CA certificate removes its records and the records of all device certificates it issued from the broker. Your local certificate files are not affected. To use these certificates for authentication again, you must re-register them.

In the CA certificate list, find the CA certificate that you want to delete and click Delete in the Actions column.
In the message that appears, click OK.