Mosquitto(MQTTS)サーバをACMによるサーバ証明書で構築してみました

% git clone https://github.com/furuya02/mqtt-attach-acm-to-nlb.git
% cd mqtt-attach-acm-to-nlb

{
  "app": "npx ts-node --prefer-ts-exts bin/cdk.ts",
  "watch": {
  },
  "context": {
    "projectName": "mqtt-attach-acm-to-nlb",
    "accountId": "xxxxxxxxxxxx",
    "vpcCidr": "10.0.0.0/16",
    "taskCpu": 256,
    "taskMemory": 512,
    "desiredCount": 0,
    "natGateways": 0,
    "certificateArn": "arn:aws:acm:ap-northeast-1:xxxxxxxxxxxx:certificate/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",

% cd cdk
% npm install
% cdk diff mqtt-attach-acm-to-nlb-stack -c tag=latest
% cdk deploy mqtt-attach-acm-to-nlb-stack -c tag=latest
% cd ..

% node deploy.js latest

docker push 123456781234.dkr.ecr.ap-northeast-1.amazonaws.com/mqtt-attach-acm-to-nlb-repo:latest
finish.

% dig mqtt-attach-acm-to-nlb-nlb-5429fb2fca447d42.elb.ap-northeast-1.amazonaws.com

;; ANSWER SECTION:
mqtt-attach-acm-to-nlb-nlb-5429fb2fca447d42.elb.ap-northeast-1.amazonaws.com. 60 IN A 43.206.49.94

% dig mqtt.alexa-dev.tokyo

;; ANSWER SECTION:
mqtt.alexa-dev.tokyo.	60	IN	A	43.206.49.94

{
  "app": "npx ts-node --prefer-ts-exts bin/cdk.ts",
  "watch": {
  },
  "context": {
    "desiredCount": 1,

% cd cdk
% cdk deploy mqtt-attach-acm-to-nlb-stack -c tag=latest
% cd ..

% mosquitto_sub -p 8883 -h mqtt.alexa-dev.tokyo -t /test --tls-version tlsv1.2
HELLO

% mosquitto_pub -p 8883 -h mqtt.alexa-dev.tokyo -t /test  -m "HELLO" --tls-version tlsv1.2

% aws ecs execute-command --region ap-northeast-1 --cluster mqtt-attach-acm-to-nlb-cluster --task ca4cfefe874543028c2f3d48516c5d9e --container mqtt-attach-acm-to-nlb-ServiceTaskContainerDefinition --interactive --command "/bin/sh"

The Session Manager plugin was installed successfully. Use the AWS CLI to start a session.

Starting session with SessionId: ecs-execute-command-gh6gvpla4n7rvy9qqvuufy6vae
/ # vi /mosquitto/log/mosquitto.log

【起動時のログ】
1735619608: mosquitto version 2.0.20 starting
1735619608: Config loaded from /mosquitto/mosquitto.conf.
1735619608: Opening ipv4 listen socket on port 1883.
1735619608: Opening ipv6 listen socket on port 1883.
1735619608: mosquitto version 2.0.20 running

【Subscribeのログ】
1735620481: New connection from 10.0.0.90:12989 on port 1883.
1735620481: New client connected from 10.0.0.90:12989 as auto-851B7011-5703-58AC-807C-D1F38BA6A18D (p2, c1, k60).
1735620481: No will message specified.
1735620481: Sending CONNACK to auto-851B7011-5703-58AC-807C-D1F38BA6A18D (0, 0)
1735620481: Received SUBSCRIBE from auto-851B7011-5703-58AC-807C-D1F38BA6A18D
1735620481: 	/test (QoS 0)
1735620481: auto-851B7011-5703-58AC-807C-D1F38BA6A18D 0 /test
1735620481: Sending SUBACK to auto-851B7011-5703-58AC-807C-D1F38BA6A18D

【Publishのログ】
1735620485: New client connected from 10.0.0.90:51004 as auto-36D04964-20DB-8768-C557-90979FAF1860 (p2, c1, k60).
1735620485: No will message specified.
1735620485: Sending CONNACK to auto-36D04964-20DB-8768-C557-90979FAF1860 (0, 0)
1735620485: Received PUBLISH from auto-36D04964-20DB-8768-C557-90979FAF1860 (d0, q0, r0, m0, '/test', ... (5 bytes))
1735620485: Sending PUBLISH to auto-851B7011-5703-58AC-807C-D1F38BA6A18D (d0, q0, r0, m0, '/test', ... (5 bytes))
1735620485: Received DISCONNECT from auto-36D04964-20DB-8768-C557-90979FAF1860
1735620485: Client auto-36D04964-20DB-8768-C557-90979FAF1860 disconnected.

% cdk destroy mqtt-attach-acm-to-nlb-stack -c tag=latest
tag: latest
Are you sure you want to delete: mqtt-attach-acm-to-nlb-stack (y/n)? y

mqtt-attach-acm-to-nlb-stack: destroying... [1/1]

 ✅  mqtt-attach-acm-to-nlb-stack: destroyed

%

FROM eclipse-mosquitto

COPY mosquitto.conf /mosquitto/mosquitto.conf
COPY run.sh /run.sh
RUN chmod +x /run.sh
CMD /run.sh

echo "Starting mosquitto"
/usr/sbin/mosquitto -c /mosquitto/mosquitto.conf -v

listener 1883

allow_anonymous true

log_dest file /mosquitto/log/mosquitto.log
log_type all

connection_messages true

// TLSでListenする場合
const nlbListener = nlbForApp.addListener(`nlbListener`, {
    protocol: elbv2.Protocol.TLS,
    port: 8883,
    certificates: [
        {
            certificateArn: certificateArn,
        },
    ],
});

// TLSなしでListenする場合
const nlbListener = nlbForApp.addListener(`nlbListener`, {
   port: 1883,
});