Cannot connect IoT Hub using X509 CA certificate by mosquitto, paho

Question

thank you for the great document. and tutorials. I am still stack in connecting IoT Hub using mosquitto. I guess I set all of the option written here as clientId, Username, topic name. Are there any additional option should I add? thanks for your help!

$ openssl genrsa -out rootCA.key 2048
$ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
$ # Upload rootCA.pem to IoT Hub and get verification code
$ openssl genrsa -out verificationCert.key 2048
$ openssl req -new -key verificationCert.key -out verificationCert.csr
# create csr with CN=[verification code]
$ openssl x509 -req -in verificationCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out verificationCert.pem -days 500 -sha256
$ # upload verificationCert.pem and pass verificaton
$ openssl genrsa -out deviceCert.key 2048
$ openssl req -new -key deviceCert.key -out deviceCert.csr
$ openssl x509 -req -in deviceCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out deviceCert.pem -days 500 -sha256
$ # create Device in IoT Hub
$ mosquitto_pub -d -h $myhub.azure-devices.net -p 8883 --cafile /etc/ssl/certs/Baltimore_CyberTrust_Root.pem --cert ./deviceCert.pem --key ./deviceCert.key -i $mydevice -u "$myhub.azure-devices.net/$mydevice/?api-version=2018-06-30" -t "/devices/$mydevice/messages/events/" -m '{"message": "Hello IoT Hub!"}'
Client [deviceName] sending CONNECT
Error: The connection was lost.

I also failed by paho. https://learn.microsoft.com/en-us/azure/iot-hub/iot-hub-mqtt-support#tlsssl-configuration my code is following.

from paho.mqtt import client as mqtt
import ssl

path_to_root_cert = "/etc/ssl/certs/Baltimore_CyberTrust_Root.pem"
device_id = "mydevice"
iot_hub_name = "myhub"


def on_connect(client, userdata, flags, rc):
    print("Device connected with result code: " + str(rc))


def on_disconnect(client, userdata, rc):
    print("Device disconnected with result code: " + str(rc))


def on_publish(client, userdata, mid):
    print("Device sent message")


client = mqtt.Client(client_id=device_id, protocol=mqtt.MQTTv311)

client.on_connect = on_connect
client.on_disconnect = on_disconnect
client.on_publish = on_publish

# Set the username but not the password on your client
client.username_pw_set(username=iot_hub_name+".azure-devices.net/" +
                       device_id + "/?api-version=2018-06-30", password=None)

# Set the certificate and key paths on your client
cert_file = "./deviceCert.pem"
key_file = "./deviceCert.key"
client.tls_set(ca_certs=path_to_root_cert, certfile=cert_file, keyfile=key_file,
               cert_reqs=ssl.CERT_REQUIRED, tls_version=ssl.PROTOCOL_TLSv1, ciphers=None)

# Connect as before
client.connect(iot_hub_name+".azure-devices.net", port=8883)

client.publish("devices/" + device_id + "/messages/events/", "{id=123}", qos=1)
client.loop_forever()

the result was following which means unauthorized.

Device connected with result code: 5
Device disconnected with result code: 5

JFYI, I could connect to AWS IoT using own CA cert by following step

$ openssl genrsa -out rootCA.key 2048
$ openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.pem
$ openssl genrsa -out verificationCert.key 2048
$ aws iot get-registration-code  
$ openssl req -new -key verificationCert.key -out verificationCert.csr
$ openssl x509 -req -in verificationCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out verificationCert.pem -days 500 -sha256
$ # use the registration code as CN
$ aws iot register-ca-certificate --ca-certificate file://rootCA.pem --verification-cert file://verificationCert.pem  
$ aws iot update-ca-certificate --certificate-id [id which got above] --new-status ACTIVE  
$ openssl genrsa -out deviceCert.key 2048
$ openssl req -new -key deviceCert.key -out deviceCert.csr
$ openssl x509 -req -in deviceCert.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out deviceCert.pem -days 500 -sha256
$ aws iot register-certificate --certificate-pem file://deviceCert.pem --ca-certificate-pem file://rootCA.pem  
$ aws iot update-certificate --certificate-id [id which got above] --new-status ACTIVE  
$ mosquitto_pub -h [endpoint].iot.ap-northeast-1.amazonaws.com -p 8883 --cafile ./rootCA.pem --cert ./deviceCert.pem --key ./deviceCert.key -q 1 -d -t topic/test -i testdevice -m "Hello, World"
$ # rootCA is the CA I've got from https://www.amazontrust.com/repository/AmazonRootCA1.pem

Answer 1

I can connect just fine with mosquitto_pub, using the exact same steps as you to create the various keypairs. Note that you have a mistake in the topic, it should not start with a / (for your Paho sample, you got it right though). A few things you should check:

• can you confirm you provisioned your device in IoT hub as X.509 CA Signed, and not "self-signed"?
• CN for your device cert should not contain special characters or white space, and you should use the exact same name (your $mydevice variable) as the Device ID to create the "X.509 CA Signed" device in your IoT Hub.