Using SSL cert/key pair stored in AWS Secrets Manager

[TheBroach]

Hi!
I'm implementing the HiveMQ MQTT Client in a Quarkus 2.15 project, and I need to supply an SSL cert/key pair when connecting to the MQTT broker. Currently we store these in AWS Secrets Manager. The MQTT Client wants a KeyManagerFactory and a TrustManagerFactory, I just wanted to check if Quarkus has any helpful tools for this situation - or if anyone here has some useful tips? (Looking around for examples, I naturally find more examples on reading cert/key pairs from disk, often at startup/through application properties, but in this case we fetch them at runtime...)

Thankful for any hints!

[sberyozkin]

Hi, for Vert.x HTTP clients, HttpClientOptionsCustomizer exists which can be used to fetch key pairs at runtime, but I'm not sure how to customize for the messaging clients, CC @cescoffier

[cescoffier]

I don't know the Hive MQTT client, but you should be able to configure the TLS certs/key.

If you use reactive messaging (the MQTT connector), you can expose a bean producing a MqttClientSessionOptions object.

[TheBroach]

Thanks for the input Clement!

I'm actually open to try other MQTT Clients - trying out and evaluating different ones is actually what I'm doing right now. We have a PoC where we tried out the AWS IoT MQTT Client (Both dynamic topics and cert/key was very straightforward with the AWS Client I must say, just passing strings as arguments into methods in fluent builder chains). I read up on the Reactive Messaging Client, but was a bit intimidated by how cumbersome it seemed to subscribe to topics dynamically at runtime. It was really hard to find documentation and examples, this was the only thing I found, but I don't know if there's an easier way?

[cescoffier]

No you cannot easily subscribe to topics dynamically except if you can have a regexp matching all the topics you are interested in.

See: https://smallrye.io/smallrye-reactive-messaging/4.5.0/mqtt/mqtt/