在使用openssl list 发现了gost

openssl list -digest-commands
blake2b512        blake2s256        gost              md4               
md5               rmd160            sha1              sha224            
sha256            sha3-224          sha3-256          sha3-384          
sha3-512          sha384            sha512            sha512-224        
sha512-256        shake128          shake256          sm3       

测试结果：

echo "" | openssl sha256
(stdin)= 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
echo "" | openssl gost
(stdin)= 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
echo "https://const.net.cn/" | openssl gost
(stdin)= d1865af543db74fbaae644002ebf838b4ff22b09fd9b8452813736dc1239964b
echo "https://const.net.cn/" | openssl sha256
(stdin)= d1865af543db74fbaae644002ebf838b4ff22b09fd9b8452813736dc1239964b

发现gost hash算法与sha256一样。。。
GOST R 34.11-2012是新的俄罗斯哈希函数标准。从2013年1月开始，GOST R 34.11-2012哈希函数已成为新的俄罗斯联邦标准哈希函数，取代了旧的GOST R 34.11-97。GOST R散列函数可以将最多2 512位的任何消息压缩为256位和512位，分别称为GOST R-256和GOST R-512。

在OpenSSL的obj_mac.h中

#define SN_id_GostR3411_2012_256                "md_gost12_256"
#define LN_id_GostR3411_2012_256                "GOST R 34.11-2012 with 256 bit hash"
#define NID_id_GostR3411_2012_256               982
#define OBJ_id_GostR3411_2012_256               OBJ_id_tc26_digest,2L

#define SN_id_GostR3411_2012_512                "md_gost12_512"
#define LN_id_GostR3411_2012_512                "GOST R 34.11-2012 with 512 bit hash"
#define NID_id_GostR3411_2012_512               983
#define OBJ_id_GostR3411_2012_512               OBJ_id_tc26_digest,3L

echo -n "https://const.net.cn" > openssl_test.txt
echo -n "https://const.net.cn" | openssl dgst -md5 

(stdin)= 682d2c63236af6e721794b2988fc1d44

md5sum openssl_test.txt 

682d2c63236af6e721794b2988fc1d44 openssl_test.txt

openssl dgst -md5 openssl_test.txt 

MD5(openssl_test.txt)= 682d2c63236af6e721794b2988fc1d44

openssl dgst -md5 -c openssl_test.txt 

MD5(openssl_test.txt)= 68:2d:2c:63:23:6a:f6:e7:21:79:4b:29:88:fc:1d:44

openssl dgst -md5 -r openssl_test.txt 

682d2c63236af6e721794b2988fc1d44 *openssl_test.txt

openssl dgst -md5 -r *.txt 

682d2c63236af6e721794b2988fc1d44 *openssl_test.txt

openssl dgst -md5 -r *

682d2c63236af6e721794b2988fc1d44 *openssl_test.txt

openssl dgst -md5 -r * > openssl_test.md5
cat openssl_test.md5 

682d2c63236af6e721794b2988fc1d44 *openssl_test.txt

openssl dgst -md5 -c  *

MD5(openssl_test.md5)= f8:ca:f5:9a:35:44:19:c3:95:17:c4:19:47:40:8b:d2
MD5(openssl_test.txt)= 68:2d:2c:63:23:6a:f6:e7:21:79:4b:29:88:fc:1d:44

openssl md5 -c *

MD5(openssl_test.md5)= f8:ca:f5:9a:35:44:19:c3:95:17:c4:19:47:40:8b:d2
MD5(openssl_test.txt)= 68:2d:2c:63:23:6a:f6:e7:21:79:4b:29:88:fc:1d:44

BLAKE和BLAKE2是基于丹尼尔·J·伯恩斯坦ChaCha流密码的密码散列函数。与SHA-2一样，有两种不同字大小的变体。BLAKE-256和BLAKE-224使用32位字，分别产生256位和224位的摘要大小，而BLAKE-512和BLAKE-384分别使用64位字，产生512位和384位的摘要大小。在64位的x64和ARM体系结构上运行时，BLAKE2b比SHA-3，SHA-2，SHA-1和MD5更快。BLAKE2的安全性提供类似于SHA-3，优于SHA-2：免疫长度扩展攻击，来自随机预言机的无差异性等。BLAKE的改进版本BLAKE2于2012年12月21日宣布推出。BLAKE3于2020年1月9日宣布推出。

openssl dgst -list

Supported digests:
-blake2b512 -blake2s256 -md4
-md5 -md5-sha1 -ripemd
-ripemd160 -rmd160 -sha1
-sha224 -sha256 -sha3-224
-sha3-256 -sha3-384 -sha3-512
-sha384 -sha512 -sha512-224
-sha512-256 -shake128 -shake256
-sm3 -ssl3-md5 -ssl3-sha1
-whirlpool

openssl dgst -blake2b512 可以简写为 openssl blake2b512，openssl BLAKE2b512

echo -n "https://const.net.cn" > openssl_test.txt 
openssl dgst -blake2b512 openssl_test.txt 

BLAKE2b512(openssl_test.txt)= 701fd7a8c7104bd71497d3f4d9cbaa82b392aa132dbddc02e323243a60363bb9dbd3d4ae597f9ec862695d52ab85066df22d9c4aca04df11fd9dfe4e2542ab3e

openssl dgst -blake2b512 -c openssl_test.txt 

BLAKE2b512(openssl_test.txt)= 70:1f:d7:a8:c7:10:4b:d7:14:97:d3:f4:d9:cb:aa:82:b3:92:aa:13:2d:bd:dc:02:e3:23:24:3a:60:36:3b:b9:db:d3:d4:ae:59:7f:9e:c8:62:69:5d:52:ab:85:06:6d:f2:2d:9c:4a:ca:04:df:11:fd:9d:fe:4e:25:42:ab:3e

openssl dgst -blake2b512 -r openssl_test.txt 

701fd7a8c7104bd71497d3f4d9cbaa82b392aa132dbddc02e323243a60363bb9dbd3d4ae597f9ec862695d52ab85066df22d9c4aca04df11fd9dfe4e2542ab3e *openssl_test.txt

echo -n "https://const.net.cn" | openssl dgst -blake2b512 

(stdin)= 701fd7a8c7104bd71497d3f4d9cbaa82b392aa132dbddc02e323243a60363bb9dbd3d4ae597f9ec862695d52ab85066df22d9c4aca04df11fd9dfe4e2542ab3e

openssl blake2b512 openssl_test.txt 

BLAKE2b512(openssl_test.txt)= 701fd7a8c7104bd71497d3f4d9cbaa82b392aa132dbddc02e323243a60363bb9dbd3d4ae597f9ec862695d52ab85066df22d9c4aca04df11fd9dfe4e2542ab3e

openssl blake2b512 *

BLAKE2b512(openssl_test.md5)= 72cc4d0b342d407a0063b1c5a647f7385c81c8864e52ccb10665bc00742b00e6157826b69bd81c890f7b4545b0f6634f18f97231109980b995a1f333746587d8
BLAKE2b512(openssl_test.txt)= 701fd7a8c7104bd71497d3f4d9cbaa82b392aa132dbddc02e323243a60363bb9dbd3d4ae597f9ec862695d52ab85066df22d9c4aca04df11fd9dfe4e2542ab3e

openssl BLAKE2b512 *

BLAKE2b512(openssl_test.md5)= 72cc4d0b342d407a0063b1c5a647f7385c81c8864e52ccb10665bc00742b00e6157826b69bd81c890f7b4545b0f6634f18f97231109980b995a1f333746587d8
BLAKE2b512(openssl_test.txt)= 701fd7a8c7104bd71497d3f4d9cbaa82b392aa132dbddc02e323243a60363bb9dbd3d4ae597f9ec862695d52ab85066df22d9c4aca04df11fd9dfe4e2542ab3e

openssl dgst -list
Supported digests:
-blake2b512 -blake2s256 -md4
-md5 -md5-sha1 -ripemd
-ripemd160 -rmd160 -sha1
-sha224 -sha256 -sha3-224
-sha3-256 -sha3-384 -sha3-512
-sha384 -sha512 -sha512-224
-sha512-256 -shake128 -shake256
-sm3 -ssl3-md5 -ssl3-sha1
-whirlpool

用法：
openssl dgst [-digest]
或者
openssl digest
参数：
-c 参数是以冒号分隔HexString.
-hex 是输出16进制字符串，默认就是这个
-binary 是输出二进制的结果
-d 调试信息，没什么用
-out filename 将计算结果输出到文件，默认输出控制台

官方手册地址：https://www.openssl.org/docs/man1.1.1/man1/dgst.html

示例：

echo -n "https://const.net.cn" > openssl_test.txt

openssl blake2s256  openssl_test.txt 

BLAKE2s256(openssl_test.txt)= 1d550a31cf7034f24aac69abb8430474610522a8fc844ef4584d364789890feb

openssl blake2b512  openssl_test.txt 

BLAKE2b512(openssl_test.txt)= 701fd7a8c7104bd71497d3f4d9cbaa82b392aa132dbddc02e323243a60363bb9dbd3d4ae597f9ec862695d52ab85066df22d9c4aca04df11fd9dfe4e2542ab3e

openssl md4  openssl_test.txt 

MD4(openssl_test.txt)= d6dd1d2a616b6a480c6ce417b517734b

openssl md5  openssl_test.txt 

MD5(openssl_test.txt)= 682d2c63236af6e721794b2988fc1d44

openssl md5-sha1  openssl_test.txt 

MD5-SHA1(openssl_test.txt)= 682d2c63236af6e721794b2988fc1d44520fc9bd671e47fd9bd8961d88baacb4d356494a

openssl ripemd  openssl_test.txt 

RIPEMD160(openssl_test.txt)= b4967924b4475514dba56090e82656d710e92d1c

openssl ripemd160  openssl_test.txt 

RIPEMD160(openssl_test.txt)= b4967924b4475514dba56090e82656d710e92d1c

openssl rmd160  openssl_test.txt 

RIPEMD160(openssl_test.txt)= b4967924b4475514dba56090e82656d710e92d1c

openssl sha1  openssl_test.txt 

SHA1(openssl_test.txt)= 520fc9bd671e47fd9bd8961d88baacb4d356494a

openssl sha224  openssl_test.txt 

SHA224(openssl_test.txt)= 4a4c7f39fe288a3125e1095cc940d13efd18a61839611b0ac5865738

openssl sha256  openssl_test.txt 

SHA256(openssl_test.txt)= 8564929a323c97aa80d5be728fc2b7c53241926d138decb4d30f8cae1e36750f

openssl sha3-224  openssl_test.txt 

SHA3-224(openssl_test.txt)= 3f91daa869ff38c9e289d8b20bfb30f35cd24b1ade2d60e117b6f705

openssl sha3-256  openssl_test.txt 

SHA3-256(openssl_test.txt)= 2d2120298f04f9ccf45eb104a1a832b72dc36e92df83697ddf41381937f8a9d7

openssl sha3-384  openssl_test.txt 

SHA3-384(openssl_test.txt)= 9a5de69d2997788656d11b8dbe3007e74c4c116aa4759495e684d6a6cda9adff29e815235fcf110b799ab62ccaa0c029

openssl sha3-512  openssl_test.txt 

SHA3-512(openssl_test.txt)= bcaeaeace4c0f640325b76cda96ad8e527eedacb256afc42d3e8d68842fc694a3355d034c31faa8f8c8b00a869215a3342883f94a06503eb0c350382ae5f430e

openssl sha384  openssl_test.txt 

SHA384(openssl_test.txt)= b13f0e9e1b0a3230346eae998b4e58721afd42926625b3de532c4f13e7d70b62ab51497078de8ef394f34356da39e7bc

openssl sha512  openssl_test.txt 

SHA512(openssl_test.txt)= 8513a9c64d9f897546b9eff11a03182f000dee5df2d3c48dc24a4ac7840ec2e90eae1b99cd05f125e28ca28328b6fda9e287f725164b7c380844071c3a53a025

openssl sha512-224  openssl_test.txt 

SHA512-224(openssl_test.txt)= 1a1b23c9a9b105ef19f0bb5d95077c2fe1995f0fd90729ebc9afe42c

openssl sha512-256  openssl_test.txt

SHA512-256(openssl_test.txt)= 6eefb9b7ea272dd7374749eeeb59b3bf399652918032810e214cd7d86e9e52c6

openssl shake128  openssl_test.txt 

SHAKE128(openssl_test.txt)= e3aeecee8d193be5c58ba3df620abb03

openssl shake256  openssl_test.txt 

SHAKE256(openssl_test.txt)= 1acf0858f828d2fc6c429561c96061c73d200929ef1d05b925d19d71d2030ecb

openssl sm3  openssl_test.txt 

SM3(openssl_test.txt)= bb1318898097df76a8a992ec2ac3dac85914db06dae0851bebd4a5de9a13369f

openssl ssl3-md5  openssl_test.txt 

MD5(openssl_test.txt)= 682d2c63236af6e721794b2988fc1d44

openssl ssl3-sha1  openssl_test.txt 

SHA1(openssl_test.txt)= 520fc9bd671e47fd9bd8961d88baacb4d356494a

openssl whirlpool  openssl_test.txt 

whirlpool(openssl_test.txt)= a57446d6ff2e44fa7a72d7c6739960e6c17f9ea38a8d4032ba163ebe3c0f6d95b7e96c3dbcede63f3e7632462643d3dd10c3272e139bb1cca1873dfc2b86ab3f

本文介绍mosquitto基于tls的使用方法。

搭建mosquitto server
mkdir -p /etc/mosquitto/ca_certificates
mkdir -p /etc/mosquitto/certs

生成证书并自签名

openssl req -config ssl/openssl.cnf -new -x509 -days 3650 -extensions v3_ca -keyout ca.key -out ca.crt

会要求输入一些必要的信息，按提示输入就好。
关于-config参数，OpenSSL命令(例如,req和ca)带有一个-config参数用于指定openssl配置文件的位置.
生成服务器端证书
1.生成不加密的服务器私钥

openssl genrsa -out server.key 2048

2.生成服务器证书签名请求

openssl req -config ssl/openssl.cnf -out server.csr -key server.key -new

3.服务器证书请求签名

openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 3650

Signature ok
将server.crt和server.key复制到/etc/mosquitto/certs/目录

生成客户端证书
1.生成不加密的客户端私钥

openssl genrsa -out client.key 2048

2.生成客户端证书签名请求

openssl req -config ssl/openssl.cnf -out client.csr -key client.key -new

3.客户端证书请求签名

openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 3650

将client.crt和client.key复制到/etc/mosquitto/certs/目录

allow_anonymous true
user nobody
listener 8883
cafile /etc/mosquitto/ca_certificates/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
tls_version tlsv1.2
require_certificate true
use_identity_as_username true

运行mosquitto broker.

mosquitto -c mosquitto.conf -v 

后台运行就用

mosquitto -c mosquitto.conf　-d

客户端使用示例

mosquitto_sub -h localhost --cert client.crt --key client.key --cafile ca.crt -t "/client/v1" --insecure -q 2

常见错误与常识
Error: Unsupported tls_version tlsv1
这个将配置文件中改为tlsv1.2就好。
openssl 指定 openssl.cnf
OpenSSL命令(例如,req和ca)带有一个-config参数用于指定openssl配置文件的位置.
Unable to drop privileges to 'mosquitto' because this user does not exist. Trying 'nobody' instead
这个在配置文件中指定 user nobody就好。
error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)
这个是openssl报的错误，可能文件找不到，或者没有权限，openssl默认生成的key可能只有600的权限。
mosquitto tls证书单向认证与双向认证切换
单向认证只需要注释两行即可:

require_certificate true

use_identity_as_username true

mosquitto tls 要求双向认证
require_certificate true
use_identity_as_username true

关于 mosquitto-tls　官方手册地址：https://mosquitto.org/man/mosquitto-tls-7.html
mosquitto mqtt broker 官方测试服务器　https://test.mosquitto.org/　
支持 mosquitto mqtt 常见端口
1883 : MQTT, unencrypted, unauthenticated
1884 : MQTT, unencrypted, authenticated
8883 : MQTT, encrypted, unauthenticated
8884 : MQTT, encrypted, client certificate required
8885 : MQTT, encrypted, authenticated
8887 : MQTT, encrypted, server certificate deliberately expired
8080 : MQTT over WebSockets, unencrypted, unauthenticated
8081 : MQTT over WebSockets, encrypted, unauthenticated
8090 : MQTT over WebSockets, unencrypted, authenticated
8091 : MQTT over WebSockets, encrypted, authenticated

官方还贴心的可以帮忙签发客户端证书来测试。