unity3d M2MQTT参数异常:不支持的HMAC

yrdbyhpb  于 2023-01-05  发布在  Mac
关注(0)|答案(1)|浏览(311)

我尝试在Unity(C#)中设置一个MQTT客户端,它将与AWS IoT Core通信。以下是我采取的步骤:
1)使用来自AWS的证书文件生成.pfx文件:
第一个月
2)将.pem和.pfx文件放在项目的Resources文件夹中。代码中设备认证的路径为:deviceCertPath="Assets/Resources/certificate.cert.pfx"
3)添加M2Mqtt.net dll到插件文件夹(从NuGet下载)
4)我的代码如下:

using System.Collections;
using System.Collections.Generic;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
using UnityEngine;

using uPLibrary.Networking.M2Mqtt;
using uPLibrary.Networking.M2Mqtt.Messages;

// Variables

private void Start()   
{
    caCert = X509Certificate2.CreateFromCertFile(caCertPath);
    deviceCert = new X509Certificate2(deviceCertPath);

    client = new MqttClient(broker, port, true, caCert, deviceCert, MqttSslProtocols.TLSv1_2);

    client.MqttMsgPublishReceived += Client_MqttMsgPublishReceived;
    client.MqttMsgSubscribed += Client_MqttMsgSubscribed;

    //Connect
    client.Connect(clientId);
    Debug.Log($"Connected to AWS IoT with client id: {clientId}.");
}

// Message Methods

当我尝试运行代码时,我得到了一个错误,这是在尝试创建deviceCert时发生的(代码片段中的第16行对应于错误日志中提到的第32行):

ArgumentException: unsupported HMAC
Mono.Security.X509.PKCS12.Decode (System.Byte[] data) (at <b2e147cb24644c1580a142ea3d6c249e>:0)
Mono.Security.X509.PKCS12..ctor (System.Byte[] data, System.String password) (at <b2e147cb24644c1580a142ea3d6c249e>:0)
System.Security.Cryptography.X509Certificates.X509Certificate2ImplMono.ImportPkcs12 (System.Byte[] rawData, System.String password) (at <6d7c4c8dd3624dc596686fb7270ae1e6>:0)
System.Security.Cryptography.X509Certificates.X509Certificate2ImplMono.ImportPkcs12 (System.Byte[] rawData, Microsoft.Win32.SafeHandles.SafePasswordHandle password) (at <6d7c4c8dd3624dc596686fb7270ae1e6>:0)
System.Security.Cryptography.X509Certificates.X509Certificate2ImplMono..ctor (System.Byte[] rawData, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags) (at <6d7c4c8dd3624dc596686fb7270ae1e6>:0)
Mono.X509PalImpl.ImportFallback (System.Byte[] data, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags) (at <6d7c4c8dd3624dc596686fb7270ae1e6>:0)
Mono.X509PalImplMono.Import (System.Byte[] data, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags) (at <6d7c4c8dd3624dc596686fb7270ae1e6>:0)
Mono.SystemCertificateProvider.Import (System.Byte[] data, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags, Mono.CertificateImportFlags importFlags) (at <6d7c4c8dd3624dc596686fb7270ae1e6>:0)
Mono.SystemCertificateProvider.Mono.ISystemCertificateProvider.Import (System.Byte[] data, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags, Mono.CertificateImportFlags importFlags) (at <6d7c4c8dd3624dc596686fb7270ae1e6>:0)
System.Security.Cryptography.X509Certificates.X509Helper.Import (System.Byte[] rawData, Microsoft.Win32.SafeHandles.SafePasswordHandle password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags) (at <6073cf49ed704e958b8a66d540dea948>:0)
System.Security.Cryptography.X509Certificates.X509Certificate..ctor (System.String fileName, System.String password, System.Security.Cryptography.X509Certificates.X509KeyStorageFlags keyStorageFlags) (at <6073cf49ed704e958b8a66d540dea948>:0)
System.Security.Cryptography.X509Certificates.X509Certificate..ctor (System.String fileName) (at <6073cf49ed704e958b8a66d540dea948>:0)
System.Security.Cryptography.X509Certificates.X509Certificate.CreateFromSignedFile (System.String filename) (at <6073cf49ed704e958b8a66d540dea948>:0)
MQTT.Start () (at Assets/Circulate/Scripts/Networking/MQTT/MQTT.cs:32)

当前的.pfx文件没有密码,尽管我尝试使用一个带密码的文件,但得到了相同的错误。当我检查证书的详细信息时,发现两个证书的签名哈希算法都是sha 256。我不确定为什么会收到此错误,并且我无法找到有关不受支持的HMAC的更多信息。感谢任何帮助,谢谢!

9nvpjoqh

9nvpjoqh1#

根据来源,您的例外情况是PFX MAC算法ID不是1.3.14.3.2.26(SHA-1)。
这似乎令人惊讶,因为OpenSSL仍然默认使用HMAC-SHA1作为PFX MAC,但可能您的OpenSSL版本已被修改。您应该能够通过在导出命令中添加-macalg sha1(例如openssl pkcs12 -export -in certificate.pem.crt -inkey private.pem.key -out certificate.cert.pfx -certfile AmazonRootCA1.pem -macalg sha1)来强制它使用HMAC-SHA1。
您可以通过openssl asn1parse验证MAC算法ID,例如

$ openssl asn1parse -inform der -i -in test.pfx
    0:d=0  hl=4 l=1716 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim:  INTEGER           :03
    7:d=1  hl=4 l=1658 cons:  SEQUENCE
   11:d=2  hl=2 l=   9 prim:   OBJECT            :pkcs7-data
   22:d=2  hl=4 l=1643 cons:   cont [ 0 ]
   26:d=3  hl=4 l=1639 prim:    OCTET STRING      [HEX DUMP]:3082066...<snip />
 1669:d=1  hl=2 l=  49 cons:  SEQUENCE
 1671:d=2  hl=2 l=  33 cons:   SEQUENCE
 1673:d=3  hl=2 l=   9 cons:    SEQUENCE
 1675:d=4  hl=2 l=   5 prim:     OBJECT            :sha1
 1682:d=4  hl=2 l=   0 prim:     NULL
 1684:d=3  hl=2 l=  20 prim:    OCTET STRING      [HEX DUMP]:9E2270B998C4A69898F29634EC0F4823E47879A0
 1706:d=2  hl=2 l=   8 prim:   OCTET STRING      [HEX DUMP]:E540B4FDBC03B6AF
 1716:d=2  hl=2 l=   2 prim:   INTEGER           :0800

从底部开始的OBJECT :sha1 5行是MAC算法标识符。(该行的特定偏移量(例如1675)将取决于您的特定PFX,但该行将始终是从底部开始的5行)

相关问题