All Products
Search

This Product

    ApsaraMQ for MQTT:Manage SM certificates

    Document Center

    ApsaraMQ for MQTT:Manage SM certificates

    Last Updated:Jun 22, 2026

    Overview

    Message Queue for MQTT supports Chinese commercial cryptographic algorithms (SM2, SM3, and SM4) and complies with the GB/T 38636-2020 Transport Layer Cryptography Protocol (TLCP) for dual-certificate SM communication and RFC 8998 for single-certificate SM mode with TLS 1.3. To enable the SM feature, upload SM certificates through the custom certificate feature.

    Prerequisites

    Install the Tongsuo SM implementation library.

    Notes

    • To use the SM feature, submit a ticket to request activation.

    • The SM feature is supported only for Platinum Edition and Professional Edition instances of Message Queue for MQTT.

    • The SM feature is available in the following regions: China (Hangzhou), China (Shanghai), China (Beijing), China (Shenzhen), China (Ulanqab), China (Zhangjiakou), China (Guangzhou), Singapore, and Germany (Frankfurt).

    Procedure

    1. The SM feature follows the same mutual authentication process as custom X.509 certificates, but uses different commands and algorithms to generate certificates. For detailed instructions, see the certificate usage guide in the official Tongsuo documentation.

    2. Generate certificates.

      1. This example assumes that Tongsuo is installed at /home/admin/tongsuo:

      $ll /home/admin/tongsuo
total 16
drwxrwxr-x 2 admin admin 4096 Dec 16 14:28 bin
drwxrwxr-x 3 admin admin 4096 Dec 16 14:28 include
drwxrwxr-x 5 admin admin 4096 Dec 16 14:28 lib64
drwxrwxr-x 5 admin admin 4096 Dec 16 14:28 ssl

      1. For the certificate creation script and configurations, see mkcert.sh, ca.conf, and subca.conf in the Tongsuo official documentation for certificates. In mkcert.sh, update the Tongsuo installation directory and set the following environment variables before you run the script:

      export LD_LIBRARY_PATH=/home/admin/tongsuo/lib64:$LD_LIBRARY_PATH
export PATH=/home/admin/tongsuo/bin:$PATH

      1. Running the script generates the following certificates:

        $ll /home/admin/sm2-tlcp
total 104
-rw-rw-r-- 1 admin admin 3328 Jan 16 10:36 ca.cnf
-rw-rw-r-- 1 admin admin  709 Jan 16 10:45 ca.crt
-rw-rw-r-- 1 admin admin  513 Jan 16 10:45 ca.csr
-rw------- 1 admin admin  241 Jan 16 10:45 ca.key
-rw-rw-r-- 1 admin admin 1422 Jan 16 10:45 chain-ca.crt
-rw-rw-r-- 1 admin admin 1409 Jan 16 13:55 client_enc.crt
-rw-rw-r-- 1 admin admin  513 Jan 16 10:45 client_enc.csr
-rw------- 1 admin admin  241 Jan 16 10:45 client_enc.key
-rw-rw-r-- 1 admin admin 1413 Jan 16 13:55 client_sign.crt
-rw-rw-r-- 1 admin admin  517 Jan 16 10:45 client_sign.csr
-rw------- 1 admin admin  241 Jan 16 10:45 client_sign.key
drwxrwxr-x 2 admin admin 4096 Jan 16 10:45 crl
drwxrwxr-x 2 admin admin 4096 Jan 16 10:45 db
-rw-rw-r-- 1 admin admin 2393 Jan 16 10:45 mkcert.sh
drwxrwxr-x 2 admin admin 4096 Jan 16 10:45 newcerts
drwxrwxr-x 2 admin admin 4096 Jan 16 10:45 private
-rw-rw-r-- 1 admin admin  700 Jan 16 10:45 server_enc.crt
-rw-rw-r-- 1 admin admin  513 Jan 16 10:45 server_enc.csr
-rw------- 1 admin admin  241 Jan 16 10:45 server_enc.key
-rw-rw-r-- 1 admin admin  700 Jan 16 10:45 server_sign.crt
-rw-rw-r-- 1 admin admin  517 Jan 16 10:45 server_sign.csr
-rw------- 1 admin admin  241 Jan 16 10:45 server_sign.key
-rw-rw-r-- 1 admin admin 4047 Jan 16 10:37 subca.cnf
-rw-rw-r-- 1 admin admin  713 Jan 16 10:45 subca.crt
-rw-rw-r-- 1 admin admin  509 Jan 16 10:45 subca.csr
-rw------- 1 admin admin  241 Jan 16 10:45 subca.key

    3. Upload the issued server-side signing and encryption dual certificates to the Alibaba Cloud Certificate Management Service console.

      1. In the left-side navigation pane, choose Certificate Management > SSL Certificate Management V2.0. On the Uploaded Certificates tab, click Upload Certificate.

      2. For Certificate Algorithm, select SM2 Algorithm.

      3. Enter a custom Certificate Name.

      4. For Certificate File, upload the server_sign.crt file.

      5. For Certificate Key, upload the server_sign.key file.

      6. For Encryption Certificate, upload the server_enc.crt file.

      7. For Encryption Private Key, upload the server_enc.key file.

    4. Upload the CA certificate (ca.crt) in the Message Queue for MQTT console.

      1. In the left-side navigation pane, choose Certificate Management > CA Certificate. Click Register Certificate.

      2. Upload the Verification Certificate.

      3. Upload the CA Certificate.

    5. For client certificate configuration, see the code demo. Key settings:

      MQTTAsync_SSLOptions ssl =MQTTAsync_SSLOptions_initializer;
// Specify the CA certificate and the client's signing and encryption certificates and keys.
ssl.trustStore = "/home/admin/sm2-tlcp/chain-ca.crt";
ssl.enable_ntls = 1;
ssl.sign_cert_file = "/home/admin/sm2-tlcp/client_sign.crt";
ssl.sign_key_file = "/home/admin/sm2-tlcp/client_sign.key";
ssl.enc_cert_file = "/home/admin/sm2-tlcp/client_enc.crt";
ssl.enc_key_file = "/home/admin/sm2-tlcp/client_enc.key";