Using username in a TLS context is inappropriate about vernemq

[ioolkos]

@dblas thanks, labeling this a feature request to extract ClientID from ClientCert Common Name (instead of Username, but it'd be a global once set)

---

👉 Thank you for supporting VerneMQ: https://github.com/sponsors/vernemq
👉 Using the binary VerneMQ packages commercially (.deb/.rpm/Docker) requires a paid subscription.

[dblas]

Thank to you but not INSTEAD, at the same time!
My request is NOT to replace username by clientID but to offer another proposal to those, like me, who want to use clientID instead of or in addition to username.
db

[mths1]

@dblas : I can understand the need, and it would also be an easy enhancement (implementation-wise, non-proxy case). There are some things to consider:

• The client id is not optional according to spec. So what should be done if there is a client_id?
• Proxy protocol needs to be checked what is there and what is not
• We would need some new config e.g. instead of

listener.ssl.use_identity_as_username
we could have something like
listener.ssl.cert_username_as = [mqtt, cn, san] listener.ssl.cert_client_id_as = [mqtt, cn, san]
or similar. I'd be willing to implement that if you would come up with a nice proposal (which is approved by @ioolkos) on how the configuration would look like and how to handle edge cases.