Azure IoT Hub で CA 証明書を使う

こちらの記事とほぼ同じ内容です。
[Azure IoT Hub に openssl で作成した X.509 証明書をつかって mosquitto で接続する](https://qiita.com/n_mikuni/items/403f17fd323b003bdf0f)

リソースグループ　rs-aa
IoTHub  iot-aa
Device  pansy

CA 証明書の作成と IoT Hub への登録

```bash:go_create.sh
#
#
HubName=iot-aa
CertName=mycert
RgName=rs-aa
#
#
# ルート証明書の作成
# subject は適宜修正してください
openssl genrsa -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem  -subj "/C=JP/ST=Tokyo/O=TestOrg/OU=TestOu"

# ルート証明書のアップロード

az iot hub certificate create --hub-name ${HubName} --name ${CertName} --path ./rootCA.pem -g ${RgName}

# verification code の取得
etag=`az iot hub certificate show -n ${CertName} --hub-name ${HubName} -o tsv --query etag`
VeriCode=`az iot hub certificate generate-verification-code --etag ${etag} --name ${CertName} --hub-name ${HubName} -o tsv --query properties.verificationCode`

# verification code をもとに Verification Certificate (検証証明書) を作成する。
# Common Name を verification code にする。その他の subject は適宜修正してください
openssl genrsa -out verificationCert.key 2048
openssl req -new -key verificationCert.key -out verificationCert.csr -subj "/C=JP/ST=Tokyo/O=TestOrg/OU=TestOu/CN=${VeriCode}"
openssl x509 -req -in verificationCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out verificationCert.pem -days 500 -sha256

# Verification Certificate (検証証明書) をアップロードする
etag=`az iot hub certificate show -n ${CertName} --hub-name ${HubName} -o tsv --query etag`
az iot hub certificate verify --etag ${etag} --name ${CertName} --path ./verificationCert.pem --hub-name ${HubName}

echo '**** Verificate ***'
# 以下のコマンドで True となっていれば Verificate できています。
az iot hub certificate show -n ${CertName} --hub-name ${HubName} --query properties.isVerified

```

登録が出来ているかの確認

```bash:go_verificate.sh
# 以下のコマンドで True となっていれば Verificate できています。
HubName=iot-aa
CertName=mycert
#
az iot hub certificate show -n ${CertName} --hub-name ${HubName} --query properties.isVerified
```

デバイスおよびデバイス証明書の作成

```bash:go_device.sh


# デバイスの作成
# デバイス名は適宜指定してください
HubName=iot-aa
deviceId=pansy

az iot hub device-identity create --device-id ${deviceId} --hub-name ${HubName} --auth-method x509_ca

# デバイス証明書の作成
openssl genrsa -out deviceCert.key 2048
openssl req -new -key deviceCert.key -out deviceCert.csr -subj "/C=JP/ST=Tokyo/O=TestOrg/OU=TestOu/CN=${deviceId}"
openssl x509 -req -in deviceCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out deviceCert.pem -days 500 -sha256
```

参考：デバイスを削除する方法

```bash:go_dev_delete.sh
HubName=iot-aa
deviceId=pansy

az iot hub device-identity delete --device-id ${deviceId}  --hub-name ${HubName}
```

publish

```bash:go_publish.sh

# mosquitto で接続
#
HubName=iot-aa
deviceId=pansy
#
mosquitto_pub -d -h ${HubName}.azure-devices.net -p 8883 \
 --cafile /etc/ssl/certs/Baltimore_CyberTrust_Root.pem \
 --cert ./deviceCert.pem \
 --key ./deviceCert.key -i ${deviceId} \
	 -u "${HubName}.azure-devices.net/${deviceId}" \
	 -t "devices/${deviceId}/messages/events/" \
	 -m '{"message": "Hello IoT Hub!"}'
```

subscribe

```bash:go_subscribe.sh
#
HubName=iot-aa
deviceId=pansy
#
mosquitto_sub -d -h ${HubName}.azure-devices.net -p 8883 \
 --cafile /etc/ssl/certs/Baltimore_CyberTrust_Root.pem \
 --cert ./deviceCert.pem \
 --key ./deviceCert.key -i ${deviceId} \
	 -u "${HubName}.azure-devices.net/${deviceId}" \
	 -t "devices/${deviceId}/messages/events/"
```

実行結果 (メッセージは表示されません)

```text
$ ./go_subscribe.sh
Client pansy sending CONNECT
Client pansy received CONNACK (0)
Client pansy sending SUBSCRIBE (Mid: 1, Topic: devices/pansy/messages/events/, QoS: 0, Options: 0x00)
Client pansy received SUBACK
Subscribed (mid: 1): 0
Client pansy sending CONNECT
Client pansy received CONNACK (0)
Client pansy sending SUBSCRIBE (Mid: 2, Topic: devices/pansy/messages/events/, QoS: 0, Options: 0x00)
Client pansy received SUBACK
Subscribed (mid: 2): 0
Client pansy sending CONNECT
Client pansy received CONNACK (0)
Client pansy sending SUBSCRIBE (Mid: 3, Topic: devices/pansy/messages/events/, QoS: 0, Options: 0x00)
Client pansy received SUBACK
Subscribed (mid: 3): 0
```

portal で見たデバイスの状況
![iot_ca_jun17.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/179446/081b6283-8dad-6983-7e0f-4fa69f851217.png)

az-cli で、メッセージの受信が出来ます。

```bash:receive.sh
#
HubName=iot-aa
deviceId=pansy
#
#
az iot hub monitor-events --hub-name ${HubName} --device-id ${deviceId}
#
```

実行結果

```text
$ ./receive.sh 
Starting event monitor, filtering on device: shimizu, use ctrl-c to stop...
{
    "event": {
        "origin": "pansy",
        "module": "",
        "interface": "",
        "component": "",
        "payload": "{\"message\": \"Hello IoT Hub!\"}"
    }
}
```

次のパージョンで確認しました。

```text
mosquitto_pub version 2.0.7
mosquitto_pub version 1.6.12
```