4

I've been trying to configure AWS IoT to communicate over MQTT using TLS for days on a D1 Mini board and have been running into a road block with authentication.

I've used several AWS IoT Arduino libraries such as this one that hardcodes or uses SPIFFS to store the keys, but they don't seem to be the issue. One solution suggested increasing the timeout in the PubSubClient library, but it doesn't seem to be timing out. They all result in the same wifi debug output, indicating there was a certificate exchange and after exchanging certificates, AWS closes the connection.

Here is the raw output of the ESP debugger.

I've tried many solutions such as creating a certificate through AWS and creating my own certificate following this guide. My certificates also have policies to allow full access to AWS IoT.

I appear to connect in the picture below, but it doesn't seem to be consistent. enter image description here

At this point I'm going to try a few more arduino libraries or switch services. Any recommendations would be greatly appreciated. Thank you for your time.

Improve this question
3
  • From the ESP debugger output you posted, Error: maximum number of certs added (1) - change of compile-time configuration required looks like a problem. Any reason you are not addressing the issue?
    – jww
    Oct 14, 2018 at 3:55
  • From the ESP debugger output you posted, the hostname .iot.us-west-2.amazonaws.com looks malformed to me. Maybe ESP is doing some funky formatting.
    – jww
    Oct 14, 2018 at 3:56
  • From the ESP debugger output you posted, Common Names (CN) like *.iot.us-west-2.amazonaws.com are clearly wrong. It violates the latest CA/Browser Baseline Requirements. Conforming user agents should (could?) reject the certificate as malformed.
    – jww
    Oct 14, 2018 at 3:58

1 Answer 1

Reset to default
1

I managed to resolve the connection issues by removing the comments for the CA in the library I linked and uploading the Amazon root certificate to the board as a .der file as I showed in here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.