Skip to content

Commit a193ba2

Browse files
committed
Remove extra explanation
1 parent f25eaa1 commit a193ba2

File tree

1 file changed

+0
-49
lines changed

1 file changed

+0
-49
lines changed

articles/iot-operations/manage-mqtt-broker/tutorial-tls-x509.md

Lines changed: 0 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -262,55 +262,6 @@ Client thermostat sending DISCONNECT
262262

263263
To restrict access to MQTT topics based on the client certificate attributes, create an authorization policy that maps the client certificate attributes to allowed actions on specific topics.
264264

265-
The provided command is using the `mosquitto_pub` utility to publish a message to an MQTT broker with TLS encryption and client certificate authentication. Here's a breakdown of the command and the authorization system being set up:
266-
267-
### Command Breakdown
268-
- `mosquitto_pub`: The command-line utility to publish messages to an MQTT broker.
269-
- `-t "example/topic"`: Specifies the topic to which the message is published.
270-
- `-m "example temperature measurement"`: The message payload.
271-
- `-i thermostat`: The client ID used to identify the publisher.
272-
- `-q 1`: Quality of Service level 1, ensuring the message is delivered at least once.
273-
- `-V mqttv5`: Specifies the MQTT version 5.
274-
- `-d`: Enables debug mode for detailed output.
275-
- `-h localhost`: The hostname of the MQTT broker.
276-
- `--key thermostat.key`: The client's private key file.
277-
- `--cert thermostat.crt`: The client's certificate file.
278-
- `--cafile contoso_root_ca.crt`: The CA certificate file to verify the broker's certificate.
279-
280-
### Authorization System
281-
1. **Certificates Created**:
282-
- **Client Certificate (thermostat.crt)**: Issued to the client (thermostat) and signed by an intermediate CA.
283-
- **Client Private Key (thermostat.key)**: Corresponding private key for the client certificate.
284-
- **Intermediate CA Certificate**: Signed by the root CA, used to sign client certificates.
285-
- **Root CA Certificate (contoso_root_ca.crt)**: The trusted root certificate used to verify the chain of trust.
286-
287-
2. **Attributes Mapping**:
288-
- **Client Certificate Attributes**: Includes details like Common Name (CN), Organization (O), and Organizational Unit (OU) that can be used for authorization.
289-
- **Intermediate CA**: Ensures that client certificates are issued by a trusted entity.
290-
291-
3. **Authorization Rules**:
292-
- The MQTT broker uses the client certificate to authenticate the client.
293-
- The broker verifies the certificate chain up to the root CA.
294-
- Authorization rules can be defined based on certificate attributes (e.g., CN, O, OU) to control access to specific topics.
295-
296-
### Mermaid Diagram
297-
```mermaid
298-
graph TD
299-
A[Client: thermostat] -->|thermostat.crt| B[Intermediate CA]
300-
B -->|Signed by| C[Root CA: contoso_root_ca.crt]
301-
A -->|thermostat.key| D[MQTT Broker]
302-
D -->|Verify| C
303-
D -->|Authorize| E[Authorization Rules]
304-
E -->|Access Control| F[MQTT Topics]
305-
```
306-
307-
### Explanation
308-
1. The client (thermostat) uses its certificate (`thermostat.crt`) and private key (`thermostat.key`) to authenticate with the MQTT broker.
309-
2. The broker verifies the client's certificate against the intermediate CA, which is in turn verified against the root CA (`contoso_root_ca.crt`).
310-
3. The broker applies authorization rules based on the client's certificate attributes to control access to MQTT topics.
311-
312-
This setup ensures secure communication and controlled access to the MQTT broker using TLS and client certificate authentication.
313-
314265
1. In the Azure portal, navigate to your IoT Operations instance.
315266
1. Under **Components**, select **MQTT Broker**.
316267
1. Select the **Authorization** tab.

0 commit comments

Comments
 (0)