SSL: Certificate verify failure

RE: SSL: Certificate verify failure

Markus Tacker (he/him) — Wed, 13 Mar 2019 09:58:24 GMT

Using these steps I achieved what you were trying to to:

I created a new device and credentials using the Device API
Use the device id as the client id (note that you must use it exactly as returned in the response, e.g. "c35c5194-c91e-4e52-a8ec-4434850819d7".
Use https://www.amazontrust.com/repository/AmazonRootCA1.pem as ca.txt
Use the returned certificate and private key from (2), I replaced the \n with line breaks int the files
Use "prod/<tenantId>/m/#' to subscribe

from AWSIoTPythonSDK.MQTTLib import AWSIoTMQTTClient
import time

myMQTTClient = AWSIoTMQTTClient("c35c5194-c91e-4e52-a8ec-4434850819d7") # (2)
myMQTTClient.configureEndpoint("a2n7tk1kp18wix-ats.iot.us-east-1.amazonaws.com", 8883)
myMQTTClient.configureCredentials("ca.txt", "privatekey.txt", "certificate.txt") # (4)
myMQTTClient.configureOfflinePublishQueueing(-1)  # Infinite offline Publish queueing
myMQTTClient.configureDrainingFrequency(2)  # Draining: 2 Hz
myMQTTClient.configureConnectDisconnectTimeout(10)  # 10 sec
myMQTTClient.configureMQTTOperationTimeout(5)  # 5 sec
# Custom MQTT message callback
def customCallback(client, userdata, message):
    print("Received a new message: ")
    print(message.payload)
    print("from topic: ")
    print(message.topic)
    print("--------------\n\n")
print("Step1")
myMQTTClient.connect()
print("Connected")
print("Step2")
myMQTTClient.subscribe("prod/55e78cd0-8fe0-4da8-b73f-0aa72712d886/m/#", 1, customCallback)
print("Subscribed")
time.sleep(2)

while True:
    time.sleep(1)

Now when I run this script and my 91 DK is connected and sending data, I will see this output:

Received a new message: 
b'{"appId":"GPS","data":"$GPGGA,134714.200,6325.283,N,01026.197,E,1,12,1.0,0.0,M,0.0,M,,*69","messageType":"DATA"}'
from topic: 
prod/55e78cd0-8fe0-4da8-b73f-0aa72712d886/m/d/nrf-352656100005076/d2c
--------------


Received a new message: 
b'{"appId":"FLIP","data":"UPSIDE_DOWN","messageType":"DATA"}'
from topic: 
prod/55e78cd0-8fe0-4da8-b73f-0aa72712d886/m/d/nrf-352656100005076/d2c
--------------


Received a new message: 
b'{"appId":"FLIP","data":"NORMAL","messageType":"DATA"}'
from topic: 
prod/55e78cd0-8fe0-4da8-b73f-0aa72712d886/m/d/nrf-352656100005076/d2c
--------------

RE: SSL: Certificate verify failure

Thom van Zeijl — Wed, 13 Mar 2019 08:23:48 GMT

I used the Link Monitor (on native Windows 10 instead of the ubuntu VM) and I followed the steps in the link you mentioned. When I send an AT command to the device, it returns: Error: 'AT+CFUN? ' timed out. I am only able to send AT commands to the device when the AT client sample app is installed. In the top right, only the UART box is green, the Modem, UICC and LTE boxes are red and the PDN box is green. I changed the periodic signal quality request to 1sec. In the chart tab, it does not give any data. This indicates that there is no connection. But when I go to nrfcloud, I can see the device updating and it also returns the simulated orientation of the nrf9160dk. So there is a connection, otherwise the nrfcloud would not return any data. When the nrf9160dk is connected and gives information in nrfcloud, led 4 is turned on.

I am using a KPN simcard (of type K019) instead of the iBasis sim card that came with the dev kit. The iBasis sim card does not work here in the Netherlands. I don't think this should matter.

RE: SSL: Certificate verify failure

Markus Tacker (he/him) — Fri, 08 Mar 2019 16:24:15 GMT

A timeout typically means that there is something not working with the physical connection. Try the Link Monitor to verify that you are connected: devzone.nordicsemi.com/.../getting-started-with-nrf9160-dk

RE: SSL: Certificate verify failure

Thom van Zeijl — Fri, 08 Mar 2019 16:16:32 GMT

Thanks for the reply.

I've tried subscribing to:

prod/MY_UUID/

prod/MY_UUID/a

prod/MY_UUID/a/

prod/MY_UUID/a/alerts

prod/MY_UUID/a/alerts/

prod/MY_UUID/a/alerts/notifications

But none of them worked. I always got the timeout error. So as you have indicated it looks like something else is going on but I do not know what. Any help would be appreciated!

RE: SSL: Certificate verify failure

Markus Tacker (he/him) — Wed, 27 Feb 2019 16:40:44 GMT

on the nrfcloud.com MQTT broker you are only authorized to subscribe to topics below your mqttTopicPrefix, e.g. "prod/762bfc32-d338-4d5a-bd03-1e504e013846/" (762bfc32-d338-4d5a-bd03-1e504e013846 is a v4 UUID which will be different for you). So make sure that you concatenate your personal mqttTopicPrefix with any topic you want to subscribe to. You can request your personal mqttTopicPrefix using the https://api.nrfcloud.com/v1/account endpoint as explained here: https://docs.api.nrfcloud.com/MQTT
if you subscribe to an MQTT topic which you are not authorized to, the broker will disconnect you. Since you are seeing a timeout on your end, I suspect something else is going on.

RE: SSL: Certificate verify failure

Thom van Zeijl — Wed, 27 Feb 2019 16:05:37 GMT

Thanks for your response. Using the new root certificate I no longer get a verification failure. However, a new error occurs. See:

Step1
Connect
No handlers could be found for logger "AWSIoTPythonSDK.core.protocol.mqtt_core"
Traceback (most recent call last):
  File "./client3.py", line 31, in <module>
	myMQTTClient.subscribe("$SYS/#", 1, customCallback)
  File "/home/thom/Documents/nRF9160devkit/eclipse/aws-iot-device-sdk-python/AWSIoTPythonSDK/MQTTLib.py", line 668, in subscribe
	return self._mqtt_core.subscribe(topic, QoS, callback)
  File "/home/thom/Documents/nRF9160devkit/eclipse/aws-iot-device-sdk-python/AWSIoTPythonSDK/core/protocol/mqtt_core.py", line 303, in subscribe
	raise subscribeTimeoutException()
AWSIoTPythonSDK.exception.AWSIoTExceptions.subscribeTimeoutException
Exception in thread Thread-1 (most likely raised during interpreter shutdown):
Traceback (most recent call last):
  File "/usr/lib/python2.7/threading.py", line 801, in __bootstrap_inner
  File "/usr/lib/python2.7/threading.py", line 754, in run
  File "/home/thom/Documents/nRF9160devkit/eclipse/aws-iot-device-sdk-python/AWSIoTPythonSDK/core/protocol/internal/workers.py", line 147, in _dispatch
  File "/usr/lib/python2.7/threading.py", line 289, in __exit__
  File "/usr/lib/python2.7/threading.py", line 216, in __exit__
  File "/usr/lib/python2.7/threading.py", line 203, in release
<type 'exceptions.TypeError'>: 'NoneType' object is not callable

The "No handlers could be found for logger "AWSIoTPythonSDK.core.protocol.mqtt_core"" error is not important. The error below it is. "subscribeTimeoutException()" is a problem. Somehow the script is connected to the aws server but it can not subscribe to any topic. The topic the script should subscribe to is "$SYS/#" which is as far as I know the topic where basic information about the broker is published. The same error also occurs when the topic is different (for example the "alerts" and "messagePrefix" topics retrieved from the commands at https://docs.api.nrfcloud.com/MQTT/ ).

The code for the script is slightly extended from the one I posted originally. The extension is as follows:

def customCallback(client, userdata, message):
	print("Received a new message: ")
	print(message.payload)
	print("from topic: ")
	print(message.topic)
	print("--------------\n\n")

I've also tested the script located at https://github.com/aws/aws-iot-device-sdk-python/blob/master/samples/basicPubSub/basicPubSub.py This script gives basically the same error:

Traceback (most recent call last):
  File "./basicpubsub.py", line 110, in <module>
	myAWSIoTMQTTClient.subscribe(topic, 0, customCallback)
  File "/home/thom/Documents/nRF9160devkit/eclipse/aws-iot-device-sdk-python/AWSIoTPythonSDK/MQTTLib.py", line 668, in subscribe
	return self._mqtt_core.subscribe(topic, QoS, callback)
  File "/home/thom/Documents/nRF9160devkit/eclipse/aws-iot-device-sdk-python/AWSIoTPythonSDK/core/protocol/mqtt_core.py", line 303, in subscribe
	raise subscribeTimeoutException()
AWSIoTPythonSDK.exception.AWSIoTExceptions.subscribeTimeoutException
Exception in thread Thread-1 (most likely raised during interpreter shutdown):
Traceback (most recent call last):
  File "/usr/lib/python2.7/threading.py", line 801, in __bootstrap_inner
  File "/usr/lib/python2.7/threading.py", line 754, in run
  File "/home/thom/Documents/nRF9160devkit/eclipse/aws-iot-device-sdk-python/AWSIoTPythonSDK/core/protocol/internal/workers.py", line 147, in _dispatch
  File "/usr/lib/python2.7/threading.py", line 289, in __exit__
  File "/usr/lib/python2.7/threading.py", line 216, in __exit__
  File "/usr/lib/python2.7/threading.py", line 203, in release
<type 'exceptions.TypeError'>: 'NoneType' object is not callable

Does anyone know how to solve this?

RE: SSL: Certificate verify failure

Markus Tacker (he/him) — Thu, 21 Feb 2019 17:18:27 GMT

The root certificate mentioned in https://github.com/aws/aws-iot-device-sdk-python#id3 is deprecated and should not be used.

Go to https://docs.aws.amazon.com/iot/latest/developerguide/managing-device-certs.html and download the key for the Amazon Trust Services Endpoints.

This one should work for you: https://www.amazontrust.com/repository/AmazonRootCA1.pem