python - X509 对象不检查我在 Azure IoT 中心设备中创建自己的 CA 签名证书时设置的密码

Question

最初，我按照本教程(Powershell 变体)生成我自己的由 CA 签名的 X509 证书 - https://learn.microsoft.com/en-us/azure/iot-hub/tutorial-x509-scripts

然后，我做了以下两个场景:

1. 使用 .NET Framework 应用从我自己的笔记本电脑 (Windows 10) 到 Azure IoT 中心设备的通信。这是我的简单代码:

static void Main(string[] args)
        {
            try
            {
                // Create an X.509 certificate object.
                var cert = new X509Certificate2(@"..\test-device-auth\test-device-auth.pfx", "pass", X509KeyStorageFlags.UserKeySet);
                Console.WriteLine("cert: ");
                Console.WriteLine(cert);

                // Create an authentication object using your X.509 certificate. 
                var auth = new DeviceAuthenticationWithX509Certificate(deviceId, cert);

                // Create the device client.
                var deviceClient = DeviceClient.Create("Arduino-IoT-Hub-Temperature.azure-devices.net", auth, TransportType.Mqtt);

                if (deviceClient == null)
                {
                    Console.WriteLine("Failed to create DeviceClient!");
                }
                else
                {
                    Console.WriteLine("Successfully created DeviceClient!");
                    SendEvent(deviceClient).Wait();
                }

                Console.WriteLine("Exiting...\n");
            }
            catch (Exception ex)
            {
                Console.WriteLine("Error in sample: {0}", ex.Message);
            }
        }

在这种情况下，当传递正确的 pfx 和正确的密码短语时，程序可以正常工作。此外，当我传递不正确的密码短语或不正确的 pfx 时，它会失败 - 这完全没问题。

使用 python 脚本直接从 Raspberry Pi 3B 与 Azure IoT 中心设备进行通信。代码如下:

# -------------------------------------------------------------------------
# Copyright (c) Microsoft Corporation. All rights reserved.
# Licensed under the MIT License. See License.txt in the project root for
# license information.
# --------------------------------------------------------------------------
import os
import uuid
from azure.iot.device.aio import IoTHubDeviceClient
from azure.iot.device import Message, X509
import asyncio

messages_to_send = 10

async def main():
    hostname = "Arduino-IoT-Hub-Temperature.azure-devices.net"
    # The device that has been created on the portal using X509 CA signing or Self signing capabilities
    device_id = "test-device-auth"

    x509 = X509(
        cert_file="../test-device-auth/test-device-auth-public.pem",
        key_file="../test-device-auth/test-device-auth-private.pem",
        pass_phrase="pass",
    )

    # The client object is used to interact with your Azure IoT hub.
    device_client = IoTHubDeviceClient.create_from_x509_certificate(
        hostname=hostname, device_id=device_id, x509=x509
    )

    # Connect the client.
    await device_client.connect()

    async def send_test_message(i):
        print("sending message #" + str(i))
        msg = Message("test wind speed " + str(i))
        msg.message_id = uuid.uuid4()
        msg.correlation_id = "correlation-1234"
        # msg.custom_properties["tornado-warning"] = "yes"
        msg.content_encoding = "utf-8"
        msg.content_type = "application/json"
        await device_client.send_message(msg)
        print("done sending message #" + str(i))

    # send `messages_to_send` messages in parallel
    await asyncio.gather(*[send_test_message(i) for i in range(1, messages_to_send + 1)])

    # Finally, shut down the client
    await device_client.shutdown()

if __name__ == "__main__":
    asyncio.run(main())

    # If using Python 3.6 use the following code instead of asyncio.run(main()):
    # loop = asyncio.get_event_loop()
    # loop.run_until_complete(main())
    # loop.close()

在这种情况下，.pem 文件不受 pass_phrase 的保护，无论我设置正确、不正确还是根本不设置 pass_phrase，都没有关系。

有谁知道为什么会这样以及如何仍然使用 pass_phrase 保证其安全？

Answer 1

创建 test-device-auth-private.pem 时，它并不是作为加密 key blob 创建的，因此不需要密码。您可以通过诸如 openssl pkcs8 -in test-device-auth-private.pem -out test-device-auth-private-enc.pem -topk8 之类的方式对其进行加密，并在提示时输入密码。