6

I'm trying to set up AWS IoT authentication with using my own certificate according to the docs. I've managed to register a CA, enabled it as well as set it to auto-register. Also, created device cert & key according to the docs. When I first connect my device using the freshly generated key & cert it won't work. No sign of connection. It should publish a message to the $aws/events/certificates/registered/caCertificateID topic. In the MQTT console I'm unable to see anything in that topic. I've also tried attaching a template according to the JIT provisioning docs, same, no luck, doesn't seem anything to be happening.

When I manually register the device cert (aws iot register-certificate --certificate-pem file://deviceCert.pem --ca-certificate-pem file://rootCA.pem) it is then able to connect to AWS.

What is going wrong?

Improve this question
1
  • Are you trying to use just-in-time registration or JIT provisioning setup ? The difference is explained here
    – kert
    Commented Jul 3, 2018 at 21:58

2 Answers 2

Reset to default
6

Keep in mind, that when connecting the first time and trying to register a certificate with JIT you have to provide not only the device certificate but also the CA certificate you used to sign your device certificate (your CA in this case). You can combine the 2 certificates with

cat deviceCert.crt caCert.crt > deviceAndCA.crt

as explained here.

OK, I'm a little late to the party as this question is a couple of months old, but I guess it still deserves an answer. I ran into the same problem and spent quite some time searching for the mistake.

Improve this answer
2
  • Thanks, I forgot about this question. I have also figured it out. :)
    – haxpanel
    Commented Sep 17, 2018 at 14:55
  • Late answers are always good - it shows the question is relevant to someone (and helps to spread the rep about so there are more people who can vote)
    – Sean Houlihane
    Commented Sep 19, 2018 at 11:53
2

I ran into a similar problem with a different solution

If you create a certificate using a default openssl.cnf, or some other mechanism that generates an SSL certificate such as PHP's openssl_csr_sign, make certain your generated certificate does not have the x509_extensions set to make a CA certificate.

After three days of banging my head against the wall, I discovered that Amazon IoT will reject any device certificate that has CA:true set. Use OpenSSL to verify:

openssl x509 -in deviceCertificate.pem -text -noout

You should see something like this:

 X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE

I hope this helps someone save some time.

Improve this answer
2
  • Well, how do you change that? I changed the openssl config file but it showed me An error occurred (CertificateValidationException) when calling the RegisterCACertificate operation: CA certificate is not valid. The CA certificate does not have the basicConstraints extension as true when I tried to register the CA with AWS IoT.
    – Smoking Sheriff
    Commented Feb 11, 2020 at 5:52
  • You need basicConstraints extension to be true when you are creating a Certificate Authority, of course. However, your AWS "Thing" cannot have a CA Certificate; it just needs a regular certificate. Because of the default setting in openssl.cnf, I was accidentally making all of my Things certificates that were actually CA certificates, instead of ordinary certs. If for some reason you need a CA cert as a Thing cert, I would suggest making two; one for sigining and one for authentication with AWS.
    – SynaTree
    Commented Feb 27, 2020 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.