johscheuer
commented
6 years ago After clean up the certificates in the hsm directory I got a little bit further (executed on the same device that should act as transparent gateway):
openssl s_client -connect $(hostname):8883 -CAfile ${HOME}/edge_certs/certs/azure-iot-test-only.root.ca.cert.pem -showcerts
CONNECTED(00000003)
depth=4 CN = Azure IoT Hub CA Cert Test Only
verify return:1
depth=3 CN = Azure IoT Hub Intermediate Cert Test Only
verify return:1
depth=2 CN = edge-node.ca
verify return:1
depth=1 CN = iotedged workload ca
verify return:1
depth=0 CN = lx-daec-01.services.kapp.inovex.de
verify return:1
---
...
---
Server certificate
subject=/CN=lx-daec-01.services.kapp.inovex.de
issuer=/CN=iotedged workload ca
---
No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 5554 bytes and written 431 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 431BF7AFEA7BF73EEE1A0FAB660B16566835E25AE2E0744ABD9FE8DED3E865BD
Session-ID-ctx:
Master-Key: 42B4BE64C9D4268D63734A7BB86F31EF8D10FA0FA163FBA6625C0E2BA1BFBC69B5522C192598A0F6B1D1FBA5383B0796
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 29 22 4a e7 1a 84 45 5d-fa 33 3a 23 35 8a 29 06 )"J...E].3:#5.).
0010 - 2f 56 11 00 52 b2 82 ca-0f 5b 98 6b bc 2a 84 14 /V..R....[.k.*..
0020 - 23 44 99 0a 23 d7 88 c5-95 c2 59 36 a7 1c a5 bc #D..#.....Y6....
0030 - de 08 6f 2f 01 c8 d0 1d-c4 d1 30 71 c3 41 9f fa ..o/......0q.A..
0040 - 88 12 ab c8 74 9b 84 15-8d a9 25 40 7c 37 56 6d ....t.....%@|7Vm
0050 - cb 89 8f 63 d5 91 f9 41-83 ce 49 b9 00 61 de 02 ...c...A..I..a..
0060 - 98 0d 0c ac 85 6e 7d f3-70 24 f8 fc c8 95 a9 c3 .....n}.p$......
0070 - ba 92 9f 48 08 92 c7 ff-c7 5c 2f bc 7d 0e 14 9f ...H.....\/.}...
0080 - c9 3a 88 36 65 82 6b 72-26 57 06 42 0d b6 2b 1b .:.6e.kr&W.B..+.
0090 - ae af 45 24 bb 53 f4 d8-1c 77 8f a4 79 8f 57 f1 ..E$.S...w..y.W.
Start Time: 1533297930
Timeout : 300 (sec)
Verify return code: 0 (ok)Before I executed the following steps:
sudo systemctl stop iotedge
sudo rm /var/lib/iotedge/hsm/cert_keys/*
sudo rm /var/lib/iotedge/hsm/certs/*
sudo systemctl restart iotedgeBut if I try it from a remote device:
CONNECTED(00000005)
depth=0 CN = azure-edge
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 CN = azure-edge
verify error:num=27:certificate not trusted
verify return:1
depth=0 CN = azure-edge
verify error:num=21:unable to verify the first certificate
verify return:1
---
...
---
Server certificate
subject=/CN=azure-edge
issuer=/CN=iotedged workload ca
---
No client certificate CA names sent
---
SSL handshake has read 1697 bytes and written 524 bytes
---
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 3B83BD3174B8202F8E03052525EE54E4D69A7AC6BC1E477685AD0CA24F022A2C
Session-ID-ctx:
Master-Key: B88458406CBBCC6E4EE7F48CE8716151E4130127CA1E83039CD48E6AEB8CD10F604A676E4C27567CE9A3BE0D0B592CD5
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - 01 84 fa 8d f7 08 02 33-c2 3f 84 e5 20 6f 99 34 .......3.?.. o.4
0010 - 6d 47 46 df 08 f8 d4 7e-f5 5d fa 75 f3 67 78 3c mGF....~.].u.gx<
0020 - 4f aa 57 59 25 99 78 17-d1 e5 ff 2a 16 fc f5 7e O.WY%.x....*...~
0030 - 69 8d df 05 10 d1 57 63-47 fc 51 fa b7 23 bd bc i.....WcG.Q..#..
0040 - 3e 35 59 36 87 e1 50 5c-8f 53 57 36 d6 d4 cc 8f >5Y6..P\.SW6....
0050 - 58 08 96 0c 98 67 bd 72-db b9 24 23 9e cf 3e 50 X....g.r..$#..>P
0060 - ce 60 eb 09 58 f1 48 77-d2 0d 8e e4 17 e0 58 44 .`..X.Hw......XD
0070 - c5 32 3d 6d a0 11 53 89-f5 27 9c 90 33 37 52 52 .2=m..S..'..37RR
0080 - db 85 33 74 0e 33 f4 ba-4a b6 7e 64 39 31 44 a8 ..3t.3..J.~d91D.
0090 - 13 93 de a5 35 16 bf 2a-30 c8 86 4b 36 0a 78 3f ....5..*0..K6.x?
Start Time: 1533298369
Timeout : 300 (sec)
Verify return code: 21 (unable to verify the first certificate)
---
Mike-Ubezzi-MSFT
waltmatthews
vbadri
Sprinton
Currently I have some issues following the documentation for setting up an Azure IoT Edge Gateway on Ubuntu 16.04 (I also tried Ubuntu 18.04). Are there some missing steps or what is the best way to debug this?
As describe in the documentation I executed the following steps:
Everything looks fine until I want to connect to the edge gateway I get the following error messages from my application:
or if I try to validate it with
openssl;I also added the CA to the system CA: https://docs.microsoft.com/en-us/azure/iot-edge/how-to-create-transparent-gateway-linux#os-level but also without any success.
In the startup logs of the IoT edge runtime I can also find the correct logs:
Is there any way to debug this issue (to see where the certificates are not loaded).
I also tried some steps to validate that the certificates are working:
Document Details
⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.