Asset Tracker V2 AWS application Generate CA certificate fails

[Rudolph Aschmoneit]

Hey all,

I want to try the Asset Tracker v2 (NCS v1.6.0) Application in AWS, so I followed this guide.

When I try to create the CA certificates and register them in AWS via the node cli create-ca command I get the following error:

ERROR create-ca failed!
ERROR CertificateValidationException: CA certificate is not valid. The CA certificate does not have the basicConstraints extension as true

it fails after the openssl x509 subcommand, more precisely after it created rootCA.pem certificate locally.

I am an absolute newbie in AWS, so maybe I get some things wrong, but I can't see any certificates in the AWS Certificate Manager, so my guess is, that the creation fails at the point where it want's to register the certificates to AWS.

I also found this post on Stack Overflow, so it seems like an issue with the open ssl config, but your openssl subcommand seems not to use any external config file, so maybe my default / system openssl is the problem here? It's version is LibreSSL 2.8.3 on a MacOS Big Sur 11.4.

I would be thankful for any hint's, ideas, input, etc.

Best Regards
Rudolph

[Markus Tacker (he/him)]

It sounds like a problem with your system or Mac OS 11 in general.

The AWS project is only tested against Mac OS 10 and support for Mac OS 11 is not yet available on GitHub.

So right now I unfortunately don't have a way to reproduce this problem.

However I am open to use an Open SSL config file to not depend on the system default, which sounds like a good improvement.

If you figure out a working configuration, feel free to open a PR in the repo so we can ensure that it works with Linux and Mac OS 10.

[Rudolph Aschmoneit]

Hey, thanks for your fast reply. Ok, I will check this out and if I found a working configuration I will open a PR.

[Rudolph Aschmoneit]

Another thing I totally forget to mention: I try to set every thing up in eu-central-1, just to test if this working, because i would to prefer this region. Could this also be part of this specific problem? AWS certification manager should be available in this region and also installing of the Asset Tracker in my AWS account was successful.

[Markus Tacker (he/him)]

In the Azure flavor I stared to use that approach, which might be a helpful example: github.com/.../generateDeviceCertificate.ts

[Markus Tacker (he/him)]

I don't think so, but just to be sure I've started a test run with multiple regions: github.com/.../files