Broker Client Certificate Authentication example

[vontas-erk]

Hi,

I am looking for any examples related to configuring an MQTTnet server to utilize client certificate authentication (mTLS). I currently have the configuration below:

var optionsBuilder = new MqttServerOptionsBuilder()
    .WithoutDefaultEndpoint()
    .WithEncryptedEndpoint()
    .WithEncryptedEndpointPort(this.MqttServiceConfiguration.TlsPort)
    .WithEncryptionCertificate(brokerCertificate.Export(X509ContentType.Pfx))
    .WithEncryptionSslProtocol(SslProtocols.Tls12)
    .Build();

optionsBuilder.TlsEndpointOptions.ClientCertificateRequired = true;

optionsBuilder.TlsEndpointOptions.RemoteCertificateValidationCallback += (sender, cer, chain, sslPolicyErrors) =>
{
    try
    {
        if (sslPolicyErrors == SslPolicyErrors.None)
        {
            return true;
        }

        var test = cer.GetCertHashString();

        if (sslPolicyErrors == SslPolicyErrors.RemoteCertificateChainErrors)
        {
            // If using production certificates this code would be valid....

            chain.ChainPolicy.RevocationMode = X509RevocationMode.NoCheck;
            chain.ChainPolicy.VerificationFlags = X509VerificationFlags.NoFlag;
            chain.ChainPolicy.ExtraStore.Add(caCert);
            chain.Build((X509Certificate2)cer);
            return chain.ChainElements.Cast<X509ChainElement>().Any(a => a.Certificate.Thumbprint == caCert.Thumbprint);

            // Using self-signed certs so return true

            //return true;
        }
    }
    catch { }

    return false;
};

and have been relying on this documentation --> https://github.com/dotnet/MQTTnet/wiki/Server#example.

Is there a section that I am missing? Does RemoteCertificateValidationCallback handle the client certificate authentication?