ClaudioBaldo
commented
2 years ago The problem seems to be with reading the client certificate which seem I can provision all right (it will return true) but then it will fail when we try to connect to the backend when mbetls tries to load it for establishing the connection. I have added a couple of lines to the logs for debugging and I am not sure why this is happening.
mqttClientAws.c connectToServerWithBackoffRetries() 654 | ===SUCCESSFULLY INITIALIZED PKCS #11.=== mqttClientAws[7891] | [DEBUG] [FLEET_PROVISIONING_DEMO] [pkcs11_operations.c:808] loadClaimCredentials readFile claimCert, 1^M mqttClientAws[7891] | [DEBUG] [FLEET_PROVISIONING_DEMO] [pkcs11_operations.c:814] loadClaimCredentials readFile claimPrivateKey, 1^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:483] Successfully found object class attribute.^M mqttClientAws[7891] | [INFO] [PKCS11] [core_pkcs11_mbedtls.c:2823] Creating a 0x3 type object.^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:2057] Successfully found the key type in the template.^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:2086] Successfully found the label in the template.^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:1259] Key was private type.^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:1268] Received RSA key type.^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:1288] Allocating a 1200 bytes sized buffer to write the key to.^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_pal_utils.c:123] Converted Device Priv TLS Key to corePKCS11_Key.dat^M mqttClientAws[7891] | Successfully wrote 1192 to corePKCS11_Key.dat[DEBUG] [FLEET_PROVISIONING_DEMO] [pkcs11_operations.c:823] loadClaimCredentials provisionPrivateKey, 1^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:3352] Search parameters other than label are ignored.^M
mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:3446] Could not find the object handle in the list. Trying to search PKCS #11 PAL for object.^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_pal_utils.c:123] Converted Device Cert to corePKCS11_Certificate.dat^M mqttClientAws[7891] | [INFO] [PKCS11] [core_pkcs11_pal.c:63] Could not open corePKCS11_Certificate.dat for reading.^M mqttClientAws[7891] | [ERROR] [PKCS11] [core_pkcs11.c:370] xFindObjectWithLabelAndClass ERROR CK_INVALID_HANDLE^M
mqttClientAws[7891] | [INFO] [FLEET_PROVISIONING_DEMO] [pkcs11_operations.c:770] Writing certificate into label "Device Cert".^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:483] Successfully found object class attribute.^M mqttClientAws[7891] | [INFO] [PKCS11] [core_pkcs11_mbedtls.c:2823] Creating a 0x1 type object.^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_pal_utils.c:123] Converted Device Cert to corePKCS11_Certificate.dat^M mqttClientAws[7891] | Successfully wrote 861 to corePKCS11_Certificate.dat[DEBUG] [FLEET_PROVISIONING_DEMO] [pkcs11_operations.c:832] loadClaimCredentials provisionCertificate, 1^M mqttClientAws[7891]/mqttClientAwsComponent T=main | mqttClientAws.c connectToServerWithBackoffRetries() 669 | ===SUCCESSFULLY PROVISIONED PKCS #11.===
mqttClientAws.c connectToServerWithBackoffRetries() 688 | Establishing a TLS session to a1ui4kt3m4uic8-ats.iot.ap-southeast-2.amazonaws.com:8883. mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:3352] Search parameters other than label are ignored.^M mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:3352] Search parameters other than label are ignored.^M mqttClientAws[7891] | [ERROR] [PKCS11] [core_pkcs11.c:370] xFindObjectWithLabelAndClass ERROR CK_INVALID_HANDLE^M mqttClientAws[7891] | [ERROR] [Transport_MbedTLS_PKCS11] [mbedtls_pkcs11_posix.c:622] Function returned ERROR.^M mqttClientAws[7891] | [ERROR] [Transport_MbedTLS_PKCS11] [mbedtls_pkcs11_posix.c:397] Failed to setup key handling by PKCS #11.^M mqttClientAws[7891] | [ERROR] [Transport_MbedTLS_PKCS11] [mbedtls_pkcs11_posix.c:308] error at configureMbedtlsCertificates. 3, invalid credentials: 3 ^M mqttClientAws[7891] | [ERROR] [Transport_MbedTLS_PKCS11] [mbedtls_pkcs11_posix.c:814] error return from configureMbedtls function. 3, invalid credentials: 3 ^M mqttClientAws[7891] | [WARN] [DEMO] [mqttClientAws.c:726] Connection to the broker failed. Retrying connection after 432 ms backoff.^M mqttClientAws[7891]/mqttClientAwsComponent T=main | mqttClientAws.c connectToServerWithBackoffRetries() 688 | Establishing a TLS session to a1ui4kt3m4uic8-ats.iot.ap-southeast-2.amazonaws.com:8883. mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:3352] Search parameters other than label are ignored.^M Jul 15 07:00:49 fx30 user.info Legato: INFO | mqttClientAws[7891] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:3352] Search parameters other than label are ignored.^M mqttClientAws[7891] | [ERROR] [PKCS11] [core_pkcs11.c:370] xFindObjectWithLabelAndClass ERROR CK_INVALID_HANDLE^M mqttClientAws[7891] | [ERROR] [Transport_MbedTLS_PKCS11] [mbedtls_pkcs11_posix.c:622] Function returned ERROR.^M mqttClientAws[7891] | [ERROR] [Transport_MbedTLS_PKCS11] [mbedtls_pkcs11_posix.c:397] Failed to setup key handling by PKCS #11.^M mqttClientAws[7891] | [ERROR] [Transport_MbedTLS_PKCS11] [mbedtls_pkcs11_posix.c:308] error at configureMbedtlsCertificates. 3, invalid credentials: 3 ^M mqttClientAws[7891] | [ERROR] [Transport_MbedTLS_PKCS11] [mbedtls_pkcs11_posix.c:814] error return from configureMbedtls function. 3, invalid credentials: 3 ^
alfred2g
paulbartell
We have tried to port the demo application but the connection is nor working and we get an error for invalid handler due to invalid certificates: mqttClientAws.c connectToServerWithBackoffRetries() 640 | rootCA /AmazonRootCA1.pem mqttClientAws.c connectToServerWithBackoffRetries() 641 | clientCRT /xxxxxxx-certificate.pem.crt mqttClientAws.c connectToServerWithBackoffRetries() 642 | clientKey /xxxxxxx-private.pem.crt mqttClientAws.c connectToServerWithBackoffRetries() 654 | ===SUCCESSFULLY INITIALIZED PKCS #11.=== mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:483] Successfully found object class attribute.^M mqttClientAws[5879] | [INFO] [PKCS11] [core_pkcs11_mbedtls.c:2823] Creating a 0x3 type object.^M mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:2057] Successfully found the key type in the template.^M mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:2086] Successfully found the label in the template.^M mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:1259] Key was private type.^M mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:1268] Received RSA key type.^M mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:1288] Allocating a 1200 bytes sized buffer to write the key to.^M mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_pal_utils.c:123] Converted Device Priv TLS Key to corePKCS11_Key.dat^M mqttClientAws[5879] | Successfully wrote 1192 to corePKCS11_Key.dat[DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:3352] Search parameters other than label are ignored.^M mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:3446] Could not find the object handle in the list. Trying to search PKCS #11 PAL for object.^M mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_pal_utils.c:123] Converted Device Cert to corePKCS11_Certificate.dat^M mqttClientAws[5879] | [INFO] [PKCS11] [core_pkcs11_pal.c:63] Could not open corePKCS11_Certificate.dat for reading.^M mqttClientAws[5879] | [ERROR] [PKCS11] [core_pkcs11.c:370] xFindObjectWithLabelAndClass ERROR CK_INVALID_HANDLE^M mqttClientAws[5879] | [INFO] [FLEET_PROVISIONING_DEMO] [pkcs11_operations.c:770] Writing certificate into label "Device Cert".^M mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:483] Successfully found object class attribute.^M mqttClientAws[5879] | [INFO] [PKCS11] [core_pkcs11_mbedtls.c:2823] Creating a 0x1 type object.^M mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_pal_utils.c:123] Converted Device Cert to corePKCS11_Certificate.dat^M mqttClientAws[5879]/mqttClientAwsComponent T=main | mqttClientAws.c connectToServerWithBackoffRetries() 668 | ===SUCCESSFULLY PROVISIONED PKCS #11.=== mqttClientAws.c connectToServerWithBackoffRetries() 686 | Establishing a TLS session to axxxxxx-ats.iot.ap-southeast-2.amazonaws.com:443. mqttClientAws[5879] | Successfully wrote 861 to corePKCS11_Certificate.dat[DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:3352] Search parameters other than label are ignored.^M mqttClientAws[5879] | [DEBUG] [PKCS11] [core_pkcs11_mbedtls.c:3352] Search parameters other than label are ignored.^M mqttClientAws[5879] | [ERROR] [PKCS11] [core_pkcs11.c:370] xFindObjectWithLabelAndClass ERROR CK_INVALID_HANDLE^M mqttClientAws[5879] | [ERROR] [Transport_MbedTLS_PKCS11] [mbedtls_pkcs11_posix.c:625] Function returned ERROR.^M mqttClientAws[5879] | [ERROR] [Transport_MbedTLS_PKCS11] [mbedtls_pkcs11_posix.c:400] Failed to setup key handling by PKCS #11.^M mqttClientAws[5879] | [WARN] [DEMO] [mqttClientAws.c:724] Connection to the broker failed. Retrying connection after 270 ms backoff.^M
This is the code we are using, which we got partly from the mqtt_operation.c in the repository: BackoffAlgorithmStatus_t backoffAlgStatus = BackoffAlgorithmSuccess; MbedtlsPkcs11Status_t tlsStatus = MBEDTLS_PKCS11_SUCCESS; BackoffAlgorithmContext_t reconnectParams; MbedtlsPkcs11Credentials_t tlsCredentials = { 0 }; const char * alpn[] = { ALPN_PROTOCOL_NAME, NULL };
/ Set the pParams member of the network context with desired transport. / pNetworkContext->pParams = &tlsContext;
/ Initialize credentials for establishing TLS session. / tlsCredentials.pRootCaPath = rootCA; tlsCredentials.pClientCertLabel = clientCRT; tlsCredentials.pPrivateKeyLabel = clientKey; pkcs11ret = xInitializePkcs11Session( &tlsCredentials.p11Session ); if( pkcs11ret != CKR_OK ) { LogError( ( "Failed to initialize PKCS #11." ) ); }
/* AWS IoT requires devices to send the Server Name Indication (SNI)
https://docs.aws.amazon.com/iot/latest/developerguide/transport-security.html */ tlsCredentials.disableSni = false; uint16_t port = AWS_IOT_MQTT_PORT;
if( port == 443 ) { /* Pass the ALPN protocol name depending on the port being used.
https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-authentication-on-port-443-why-it-is-useful-and-how-it-works/ */ tlsCredentials.pAlpnProtos = alpn; } bool status = false; if( pkcs11ret != CKR_OK ) { printf( "Failed to initialize PKCS #11."); status = false; } else { printf( "===SUCCESSFULLY INITIALIZED PKCS #11.==="); // Insert the claim credentials into the PKCS #11 module status = loadClaimCredentials( tlsCredentials.p11Session, clientCRT, pkcs11configLABEL_DEVICE_CERTIFICATE_FOR_TLS, clientKey, pkcs11configLABEL_DEVICE_PRIVATE_KEY_FOR_TLS );
if( status == false ) { printf( "Failed to provision PKCS #11 with claim credentials." ); } else printf( "===SUCCESSFULLY PROVISIONED PKCS #11.===");
} / Initialize reconnect attempts and interval / BackoffAlgorithm_InitializeParams( &reconnectParams, CONNECTION_RETRY_BACKOFF_BASE_MS, CONNECTION_RETRY_MAX_BACKOFF_DELAY_MS, CONNECTION_RETRY_MAX_ATTEMPTS );
do { /* Establish a TLS session with the MQTT broker. This example connects
the top of this file. / printf("Establishing a TLS session to %.s:%d.", BROKER_ENDPOINT_LENGTH, BROKER_ENDPOINT, AWS_IOT_MQTT_PORT ); tlsStatus = Mbedtls_Pkcs11_Connect( pNetworkContext, BROKER_ENDPOINT, port, &tlsCredentials, TRANSPORT_SEND_RECV_TIMEOUT_MS );
if( ( NULL != pxHandle ) && ( ulCount == 0UL ) ) { *pxHandle = CK_INVALID_HANDLE; LogError(("xFindObjectWithLabelAndClass ERROR CK_INVALID_HANDLE")); }
Which we don`t understand why, same certificates we are using with the older SDK for embedded C from aws. Any help will be very much appreciated!!!