* Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * + *
+ * http://www.apache.org/licenses/LICENSE-2.0 + *
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -45,18 +45,18 @@ import java.security.cert.X509Certificate;
public class MqttSslHandlerProvider {
public static final String TLS = "TLS";
- @Value("${mqtt.ssl.key-store}")
+ @Value("${mqtt.ssl.key_store}")
private String keyStoreFile;
- @Value("${mqtt.ssl.key-store-password}")
+ @Value("${mqtt.ssl.key_store_password}")
private String keyStorePassword;
- @Value("${mqtt.ssl.keyStoreType}")
+ @Value("${mqtt.ssl.key_store_type}")
private String keyStoreType;
- @Value("${mqtt.ssl.trust-store}")
+ @Value("${mqtt.ssl.trust_store}")
private String trustStoreFile;
- @Value("${mqtt.ssl.trust-store-password}")
+ @Value("${mqtt.ssl.trust_store_password}")
private String trustStorePassword;
- @Value("${mqtt.ssl.trustStoreType}")
+ @Value("${mqtt.ssl.trust_store_type}")
private String trustStoreType;
@Autowired
@@ -108,8 +108,7 @@ public class MqttSslHandlerProvider {
break;
}
}
- X509TrustManager x509TmWrapper = new ThingsboardMqttX509TrustManager(x509Tm, deviceCredentialsService);
- return x509TmWrapper;
+ return new ThingsboardMqttX509TrustManager(x509Tm, deviceCredentialsService);
}
static class ThingsboardMqttX509TrustManager implements X509TrustManager {
@@ -136,18 +135,22 @@ public class MqttSslHandlerProvider {
@Override
public void checkClientTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
+ DeviceCredentials deviceCredentials = null;
for (X509Certificate cert : chain) {
try {
String strCert = SslUtil.getX509CertificateString(cert);
String sha3Hash = EncryptionUtil.getSha3Hash(strCert);
- DeviceCredentials deviceCredentials = deviceCredentialsService.findDeviceCredentialsByCredentialsId(sha3Hash);
- if (deviceCredentials == null) {
- throw new CertificateException("Invalid Device Certificate");
+ deviceCredentials = deviceCredentialsService.findDeviceCredentialsByCredentialsId(sha3Hash);
+ if (deviceCredentials != null && strCert.equals(deviceCredentials.getCredentialsValue())) {
+ break;
}
} catch (IOException e) {
- e.printStackTrace();
+ log.error(e.getMessage(), e);
}
}
+ if (deviceCredentials == null) {
+ throw new CertificateException("Invalid Device Certificate");
+ }
}
}
}
diff --git a/transport/mqtt/src/main/java/org/thingsboard/server/transport/mqtt/util/SslUtil.java b/transport/mqtt/src/main/java/org/thingsboard/server/transport/mqtt/util/SslUtil.java
index 8fdf721cd4..d1ea59b7c1 100644
--- a/transport/mqtt/src/main/java/org/thingsboard/server/transport/mqtt/util/SslUtil.java
+++ b/transport/mqtt/src/main/java/org/thingsboard/server/transport/mqtt/util/SslUtil.java
@@ -16,6 +16,7 @@
package org.thingsboard.server.transport.mqtt.util;
import lombok.extern.slf4j.Slf4j;
+import org.thingsboard.server.dao.EncryptionUtil;
import sun.misc.BASE64Encoder;
import java.io.ByteArrayOutputStream;
@@ -32,11 +33,12 @@ public class SslUtil {
private SslUtil() {
}
- public static String getX509CertificateString(X509Certificate cert) throws CertificateEncodingException, IOException {
+ public static String getX509CertificateString(X509Certificate cert)
+ throws CertificateEncodingException, IOException {
ByteArrayOutputStream out = new ByteArrayOutputStream();
BASE64Encoder encoder = new BASE64Encoder();
encoder.encodeBuffer(cert.getEncoded(), out);
- return new String(out.toByteArray(), "UTF-8").trim();
+ return EncryptionUtil.trimNewLines(new String(out.toByteArray(), "UTF-8"));
}
public static String getX509CertificateString(javax.security.cert.X509Certificate cert)
@@ -44,6 +46,6 @@ public class SslUtil {
ByteArrayOutputStream out = new ByteArrayOutputStream();
BASE64Encoder encoder = new BASE64Encoder();
encoder.encodeBuffer(cert.getEncoded(), out);
- return new String(out.toByteArray(), "UTF-8").trim();
+ return EncryptionUtil.trimNewLines(new String(out.toByteArray(), "UTF-8"));
}
}
diff --git a/ui/src/app/device/device-credentials.controller.js b/ui/src/app/device/device-credentials.controller.js
index 315bc08318..537df5d1bb 100644
--- a/ui/src/app/device/device-credentials.controller.js
+++ b/ui/src/app/device/device-credentials.controller.js
@@ -52,13 +52,16 @@ export default function ManageDeviceCredentialsController(deviceService, $scope,
function valid() {
return vm.deviceCredentials &&
(vm.deviceCredentials.credentialsType === 'ACCESS_TOKEN'
- || vm.deviceCredentials.credentialsType === 'X509_CERTIFICATE')
- &&
- vm.deviceCredentials.credentialsId && vm.deviceCredentials.credentialsId.length > 0;
+ && vm.deviceCredentials.credentialsId
+ && vm.deviceCredentials.credentialsId.length > 0
+ || vm.deviceCredentials.credentialsType === 'X509_CERTIFICATE'
+ && vm.deviceCredentials.credentialsValue
+ && vm.deviceCredentials.credentialsValue.length > 0);
}
function clear() {
vm.deviceCredentials.credentialsId = null;
+ vm.deviceCredentials.credentialsValue = null;
}
function save() {
diff --git a/ui/src/app/device/device-credentials.tpl.html b/ui/src/app/device/device-credentials.tpl.html
index f74f71fd42..9dd4553b08 100644
--- a/ui/src/app/device/device-credentials.tpl.html
+++ b/ui/src/app/device/device-credentials.tpl.html
@@ -51,7 +51,7 @@