Closed mleister97 closed 3 years ago
Maybe I need to get rid of the IP address and really add a hostname? That would I need to create a custom DNS server just to be able to test this?
Is the ESP able to ping the Edge? Do these two devices see each other over the local network?
Yes, if you connect by IP address, then the TLS host name validation is going to fail. What is the CN value of the TLS cert on the edge gateway endpoint?
@sandervandevelde Both devices can see each other (are pingable from each other). But: Only using the IP of the gateway, not the hostname.
@ericwol-msft Thanks for your time. I think I can resolve the issue by changing the IP address of the gateway to a hostname. For this purpose I think I need to setup a local DNS including the IP address of the edge/gateway and bind it to the hostname defined in the configuration file (/etc/iotedge/config.yaml).
Is it really necessary to set up a local dns for testing purposes? Or is it possible to connect with the IP instead of the hostname? The problem is as already mentioned by @ericwol-msft most likely the tls hostname validation.
Yes, you can create a cert with the IP address as the CN subject name. I assume you are using mbed TLS on the device? Just verify that they will validate certs with IP address, but AFAIK it should.
I created a custom DNS and made sure that the hostname is pingable. So far so good. Also tried a Python example where everything worked fine - I can send messages to the IoT Hub via the Edge on my computer.
Still, I cannot send messages with my ESP8266.
I am using the same certificate and the connection string. Can anybody tell me why my example isn't working so far?
Output:
Creating IoTHub Device handle...
Sending message 1 to IoTHub...
dowork TLSIO_STATE_OPENING_WAITING_SOCKET
Sending message 2 to IoTHub...
dowork TLSIO_STATE_OPENING_WAITING_SSL
Error opening socket 0
Calling error callback
The device client has been disconnected
Error: failure opening connection to endpoint
The device client has been disconnected
Additional notes:
@ericwol-msft @sandervandevelde Any ideas why the code isn't working on ESP8266? As a said, the python example using the same connection string and certificate is working fine.
No, error points to a cert issue. You probably need to capture the network packets and look at the TLS cert exchange to understand if the cert is configured correctly. Also probably you will to trace into your TLS stack to see the SSL connect is failing.
To be honest I have no idea how to do that. The output of the following command produces this result:
openssl s_client -connect iot-edge.leister:8883 -CAfile "C:\Users\micha\Desktop\azure-iot-test-only.root.ca.cert.pem" -showcerts
I am receiving the follwing error on the edge module:
[WRN] - TLS handshake failed., System.IO.IOException: Channel is closed, 7f6b90c6
ESP8266 Logs:
dowork TLSIO_STATE_OPENING_WAITING_SOCKET
Waiting for TLS connection
dowork TLSIO_STATE_OPENING_WAITING_SSL
Error opening socket 0
Calling error callback
Error signalled by underlying IO
Waiting for TLS connection
Open HTTP connection failed (result = HTTPAPI_OPEN_REQUEST_FAILED (4))
unable to recover sending to a working state
unable to HTTPAPIEX_SAS_ExecuteRequest
Confirmation callback received for message 1 with result IOTHUB_CLIENT_CONFIRMATION_ERROR
Seems like my issue is closely related to: https://github.com/Azure/iotedge/issues/387
Finally it's working. Switched the hardware from ESP8266 to ESP32 and running (same code) without any issues!
Ok, thanks. I'm going to close out the issue.
Configured a downstream device
;GatewayHostName=<ip_address_of_raspberry>
to the connection string (String can be found below).Configured the edge device
/etc/iotedge/config.yaml
ESP8266 Logs:
How I added the certificate:
Verification of the certificate:
Results in: Verify return code: 0 (ok)
Connection string on the ESP8266: