Do you have Amazon AWS Tutorial..?

[kittinook]

Hi, I've interested this board. Do you have the example for communication between the board and AWS IoT cloud?

[tronar]

BTW, the script in sim7000-tools opens and closes the COM port with each send and receive op. This wreaks havoc specially when using a soft bridge like was my case (i.e. COM -> ESP-32 -> SIM7000)

[Aryan-Morteza]

BTW, the script in sim7000-tools opens and closes the COM port with each send and receive op. This wreaks havoc specially when using a soft bridge like was my case (i.e. COM -> ESP-32 -> SIM7000)

I agree with you, BTW the cert and key works fine in convert, 1

[Scrts]

If it's Waveshare module, then hook it up to your PC over USB, open terminal like putty and enter the commands manually. One more thing: you need to use VeriSign legacy certificate from AWS. You can find it here: https://docs.aws.amazon.com/iot/latest/developerguide/server-authentication.html Amazon Root CA certs do not work, afaik.

[Aryan-Morteza]

If it's Waveshare module, then hook it up to your PC over USB, open terminal like putty and enter the commands manually. One more thing: you need to use VeriSign legacy certificate from AWS. You can find it here: https://docs.aws.amazon.com/iot/latest/developerguide/server-authentication.html Amazon Root CA certs do not work, afaik.

Thanks @Scrts the thing is AmazonRootCA would convert fine. the two others would not.

[Scrts]

Do you want to try my files? I can send them by email.

[Aryan-Morteza]

Do you want to try my files? I can send them by email.

That's kind of you. Aryanbeta2003@gmail.com

[Aryan-Morteza]

@Scrts @tronar The problem was with my certs! I downloaded the new one and they embarked! Tomorrow I will test it to publish data to IoT core! Will let you know!

Thanks for your time and consideration, guys! Many Thanks!

[Aryan-Morteza]

Hia,

I'm trying to open a connection to AWS via MQTT port 8883. I set sslversion to 3 --->QAPI_NET_SSL_PROTOCOL_TLS_1_2. Also on the AWS IoT Core set it to IoTSecurityPolicy_TLS12_1_2_2022_10

But I'm still encountering with error, the AT+SMCONN wont work on my setting , What should I change on the AT commands?

[tronar]

Your time looks fine but NTP is giving you an error ? It depends on bearer connection, check it. (AT+SAPBR=2,1) I've my own MQTT server, so I can look at the session and see who is aborting it. May be you can do the same, it's not that hard to setup a mosquitto broker. Also, confirm certs are ok by using mosquitto_sub pointing to the AWS server...

[Scrts]

I highly suggest trying the MQTT on your PC using Mosquitto. Do you have the right policy on AWS to publish? Also does the path sdk/test/python exist? If not, I've seen AWS immediately closing the connection. Before you try publishing, try doing SMSUB and see if you can send messages from AWS IoT and see if the module receives? Try subscribing to an existing demo path.

[Aryan-Morteza]

Your time looks fine but NTP is giving you an error ? It depends on bearer connection, check it. (AT+SAPBR=2,1) I've my own MQTT server, so I can look at the session and see who is aborting it. May be you can do the same, it's not that hard to setup a mosquitto broker. Also, confirm certs are ok by using mosquitto_sub pointing to the AWS server...

AT+SAPBR=2,1 ---> ERROR I can get IP and Ping works fine. "Also, confirm certs are ok by using mosquitto_sub pointing to the AWS server..." I don't understand what exactly should I do?

[Aryan-Morteza]

I highly suggest trying the MQTT on your PC using Mosquitto. Do you have the right policy on AWS to publish? Also does the path sdk/test/python exist? If not, I've seen AWS immediately closing the connection. Before you try publishing, try doing SMSUB and see if you can send messages from AWS IoT and see if the module receives? Try subscribing to an existing demo path.

I have tested the cert and others, publishing data to AWS bia Python SDK works fine, I don't require to send msg from AWS to my device only thing in this step is to send from device to AWS IoT Core

[Scrts]

Afaik AWS will immediately close the connection if you try to do something that your policy prohibis. That's why trying to debug based on SMSUB as a first step would help.

[tronar]

Your time looks fine but NTP is giving you an error ? It depends on bearer connection, check it. (AT+SAPBR=2,1) I've my own MQTT server, so I can look at the session and see who is aborting it. May be you can do the same, it's not that hard to setup a mosquitto broker. Also, confirm certs are ok by using mosquitto_sub pointing to the AWS server...

AT+SAPBR=2,1 ---> ERROR

Mine works ... (schrug) I'm not completelly sure about the SIM7000 proc and services, but there are some dependencies. Read the command manual. NTP, AFAIK, depends on bearer session being up, and AT+SAPBR is used to close(0), open(1) or query (2) the bearer session. (cid, 1 in my example) Ping works even w/o a bearer up.

I can get IP and Ping works fine. "Also, confirm certs are ok by using mosquitto_sub pointing to the AWS server..." I don't understand what exactly should I do?

Mosquitto is an Apache project that has a broker and client tools (mosquitto_pub and mosquitto_sub). You can use the client to test whatever you want to do manually so you get an idea of who the culprit is. Divide and conquer ?

[Aryan-Morteza]

Here are the specific details of my configuration and the issue at hand:

Device: SIM7000X module Connectivity: I am using SIM7000X to connect to AWS IoT Core for MQTT communication. Configuration: I have configured the SIM7000X module with the necessary parameters including the AWS IoT Core endpoint URL, port number (8883 for MQTT over TLS), client ID, and security settings. Testing: The module is able to establish a connection successfully when using a test MQTT broker (e.g., test.mosquitto.org). However, when attempting to connect to AWS IoT Core using the provided endpoint URL (XXXXXXXXXXXX.iot.us-east-1.amazonaws.com), the connection is not successful. URL Used: a1hk1jl5lyheoa.iot.us-east-1.amazonaws.com

Additionally, I want to emphasize that I have successfully established connections to AWS IoT Core using the same certificates and credentials when utilizing the Python SDK. Hence, it appears that the issue lies specifically with the SIM7000X module's connection to AWS IoT Core.

I have performed several troubleshooting steps including:

Verifying the correctness of the AWS IoT Core endpoint URL, port number, and client ID. Ensuring that the SIM7000X module has access to the internet and that there are no firewall or network configuration issues blocking the connection. Configuring TLS/SSL with appropriate certificates, including the AmazonRootCA12.pem and device-specific certificate files. Despite these efforts, the connection to AWS IoT Core is not established successfully. When attempting to publish a message, the module returns an error.

Here is an excerpt of the commands and responses [test.mosquitto.org]:

[at+cnact?, +CNACT: 1,"10.193.154.101", OK] [AT+SNPING4="XXXXXXXXXXXXX.iot.us-east-1.amazonaws.com",3,20,100, +SNPING4: 1,52.71.21.145,60000, +SNPING4: 2,52.71.21.145,60000, +SNPING4: 3,52.71.21.145,60000, OK] [AT+SAPBR=2,1, +SAPBR: 1,3,"0.0.0.0", OK] [AT+SMCONF="URL","test.mosquitto.org","1883", OK] [+O"EM", OK, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ERROR, ATSMCNF=KEPTIE,60, ERROR] [AT+SMCONF="CLIENTID","iotconsole-84806066-427c-4179-a875-92148ce075c6", OK] [AT+SMCONF="CLEANSS",1, OK] [AT+SMCONF="QOS",1, OK] [AT+SMCONF="TOPIC","sdk/test/python", OK] [AT+SMCONF?, +SMCONF , CLIENTID: "iotconsole-84806066-427c-4179-a875-92148ce075c6", URL: "test.mosquitto.org:1883", KEEPTIME: 60, USERNAME: "", PASSWORD: "", CLEANSS: 1, QOS: 1, TOPIC: "sdk/test/python", MESSAGE: "", RETAIN: 0, OK] [AT+SMSSL=1,"AmazonRootCA12.pem","certificate.crt", OK] [AT+CSSLCFG="convert",2,"AmazonRootCA12.pem", OK] [AT+CSSLCFG="convert",1,"certificate.crt","private.key", OK] [AT+CSSLCFG="protocol",0,1, OK] [AT+CSSLCFG="ignorertctime",0,1, OK] [AT+CSSLCFG?, OK] [T+CSSLCFG="sslversion",0,3, OK] [T+NIG4"1kj-.mnw.o,,010] [AT+SMCONN, OK] [] [AT+SMPUB="sdk/test/python","5",1,1, ERROR] [] [AT+SMDISC, OK] serial closed!

I have also attached a log file containing detailed commands and responses for your reference [AWS end point].

[AT+SNPING4="XXXXXXXXXXXXXXXXX.iot.us-east-1.amazonaws.com",3,20,100, +SNPING4: 1,54.208.232.218,60000, +SNPING4: 2,54.208.232.218,60000, +SNPING4: 3,54.208.232.218,60000, OK] [AT+SAPBR=2,1, +SAPBR: 1,3,"0.0.0.0", OK] [AT+SMCONF="URL","XXXXXXXXXXXXXXXXX.iot.us-east-1.amazonaws.com","8883", OK] [AT+SMCONF="KEEPTIME",60, OK] [AT+SMCONF="CLIENTID","iotconsole-84806066-427c-4179-a875-92148ce075c6", OK] [AT+SMCONF="CLEANSS",1, OK] [A+SMCONF="QOS",1, OK] [A+MOF"TPC,dtpyhn, O] [AT+SMCONF?, +SMCONF , CLIENTID: "iotconsole-84806066-427c-4179-a875-92148ce075c6", URL: "XXXXXXXXXXX.iot.us-east-1.amazonaws.com:8883", KEEPTIME: 60, USERNAME: "", PASSWORD: "", CLEANSS: 1, QOS: 1, TOPIC: "sdk/test/python", MESSAGE: "", RETAIN: 0, OK] [A+SMSSL=1,"AmazonRootCA12.pem","certificate.crt", OK] [A+CSSLCFG="convert",2,"AmazonRootCA12.pem", OK] [ACSSLCFG="convert",1,"certificate.crt","private.key", OK] [AT+CSSLCFG="protocol",0,1, OK] [AT+CSSLCFG="ignorertctime",0,1, OK] [AT+CSSLCFG?, OK] [AT+CSSLCFG="sslversion",0,3, OK] [AT+SNPING4="XXXXXXXXXXXX.iot.us-east-1.amazonaws.com",3,20,100, +SNPING4: 1,52.20.89.239,60000, +SNPING4: 2,52.20.89.239,60000, +SNPING4: 3,52.20.89.239,60000, OK] [AT+SMCONN, ERROR] [] [AT+SMPUB="sdk/test/python","5",1,1, ERROR] [] [A+SMDISC, ERROR] serial closed!

Could you please assist me in diagnosing and resolving this issue? Any guidance, suggestions, or insights you can provide would be greatly appreciated.

I tried many others configs to establish the connection between SIM7000X and AWS IoT Core, I used a software (Windows-based) and could to successfully establish the connection w/o certs too.

[tronar]

Aryan, have you tried mosquitto_sub with your "certs" ? Does it work ? I know you said "it works with python" but there are so many things to pay attention to that having a reference implementation helps. Something along this line: $ mosquitto_sub --cafile symantec-G4.pem --cert aws.pem --key aws.key -h a1hk1jl5lyheoa.iot.us-east-1.amazonaws.com -p 8883 -t test/#

Also $ openssl s_client -connect a1hk1jl5lyheoa.iot.us-east-1.amazonaws.com:8883 -showcerts -tls1_2 should help you validate that the CA cert you are using is the one that you should...

[Aryan-Morteza]

Hi there,

I'm doing it right now. I think I need a legacy CA root to establish a connection with AWS IoT core. Have u ever succeeded in establishing a connection with cert and CA to AWS IoT core? do u have any website that I can use to download the particular CA and add that to the AWS IoT certificate manager? I tried this one: https://www.digicert.com/kb/digicert-root-certificates.htm but it seems I can establish the connection even with Python SDK.

Regards, Aryan

On Mon, Feb 19, 2024 at 4:22 PM Carlos G Mendioroz @.***> wrote:

Aryan, have you tried mosquitto_sub with your "certs" ? Does it work ? I know you said "it works with python" but there are so many things to pay attention to that having a reference implementation helps. Something along this line: $ mosquitto_sub --cafile symantec-G4.pem --cert aws.pem --key aws.key -h a1hk1jl5lyheoa.iot.us-east-1.amazonaws.com -p 8883 -t test/#

Also $ openssl s_client -connect a1hk1jl5lyheoa.iot.us-east-1.amazonaws.com:8883 -showcerts -tls1_2 should help you validate that the CA cert you are using is the one that you should...

— Reply to this email directly, view it on GitHub https://github.com/botletics/SIM7000-LTE-Shield/issues/58#issuecomment-1952811053, or unsubscribe https://github.com/notifications/unsubscribe-auth/AGZDFP775HATO7A6XGW62HLYUN35ZAVCNFSM4GKHR2S2U5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TCOJVGI4DCMJQGUZQ . You are receiving this because you commented.Message ID: @.***>

[tronar]

Aryan, you don't have to "try" CA certs, you have to use the one that is needed :) And for that, openssl s_client should help. RTFM ? I'm not using AWS broker now.

[Aryan-Morteza]

What you mean the ONE I needed, I ran the openssl s_client -connect a1hk1jl5lyheoa-ats.iot.us-east-1.amazonaws.com:8883 and the output is: CONNECTED(00000003) depth=2 C = US, O = Amazon, CN = Amazon Root CA 1 verify return:1 depth=1 C = US, O = Amazon, CN = Amazon RSA 2048 M01 verify return:1 depth=0 CN = *.iot.us-east-1.amazonaws.com verify return:1 4010E29F7F000000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:303:

Certificate chain 0 s:CN = *.iot.us-east-1.amazonaws.com i:C = US, O = Amazon, CN = Amazon RSA 2048 M01 a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: Dec 14 00:00:00 2023 GMT; NotAfter: Dec 5 23:59:59 2024 GMT 1 s:C = US, O = Amazon, CN = Amazon RSA 2048 M01 i:C = US, O = Amazon, CN = Amazon Root CA 1 a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: Aug 23 22:21:28 2022 GMT; NotAfter: Aug 23 22:21:28 2030 GMT 2 s:C = US, O = Amazon, CN = Amazon Root CA 1 i:C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2 a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: May 25 12:00:00 2015 GMT; NotAfter: Dec 31 01:00:00 2037 GMT 3 s:C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2 i:C = US, O = "Starfield Technologies, Inc.", OU = Starfield Class 2 Certification Authority a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256 v:NotBefore: Sep 2 00:00:00 2009 GMT; NotAfter: Jun 28 17:39:16 2034 GMT

Server certificate -----BEGIN CERTIFICATE----- MIIGAjCCBOqgAwIBAgIQBX2O4/fGrI8FrUCuUvBtVjANBgkqhkiG9w0BAQsFADA8 MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRwwGgYDVQQDExNBbWF6b24g UlNBIDIwNDggTTAxMB4XDTIzMTIxNDAwMDAwMFoXDTI0MTIwNTIzNTk1OVowKDEm MCQGA1UEAwwdKi5pb3QudXMtZWFzdC0xLmFtYXpvbmF3cy5jb20wggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0k2ft+pRoOgh6BZnZAK+1yQAiq5Ge9Euz t1YtUYHZYx7ucGoK15XA9F5xsQHH5pqa70eECE6XhmnQRfVlPLw5Hb41W2bFeJj3 seHx3bi7TqRNhx9gF6KKrLGo4d+eJzIAdTrmXTjCr+mMLlE4Ep01eZRWbZDcSx1U lRZIrWU/10xQyUl8evOByz4k0GYATVFKP0BfVxuL1DNTsRlqzjHC8WPAGq7z/Wbi KZ+DXqGmeUGmvdQx5RvFqC3OCjRG3SSzC0vcpY3dEtNcdbTSceMdU6FVJjQPSgwx gB1j1y6uhCWO2LaBK2xBtvKuBxFaL8BbaHRg98HRd0vXRcUW4rkzAgMBAAGjggMS MIIDDjAfBgNVHSMEGDAWgBSBuA5jiokSGOX6OztQlZ/m5ZAThTAdBgNVHQ4EFgQU caZbCxMNhVZ7uob+cE5DaiWBIE8wRQYDVR0RBD4wPIIbaW90LnVzLWVhc3QtMS5h bWF6b25hd3MuY29tgh0qLmlvdC51cy1lYXN0LTEuYW1hem9uYXdzLmNvbTATBgNV HSAEDDAKMAgGBmeBDAECATAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYB BQUHAwEGCCsGAQUFBwMCMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9jcmwucjJt MDEuYW1hem9udHJ1c3QuY29tL3IybTAxLmNybDB1BggrBgEFBQcBAQRpMGcwLQYI KwYBBQUHMAGGIWh0dHA6Ly9vY3NwLnIybTAxLmFtYXpvbnRydXN0LmNvbTA2Bggr BgEFBQcwAoYqaHR0cDovL2NydC5yMm0wMS5hbWF6b250cnVzdC5jb20vcjJtMDEu Y2VyMAwGA1UdEwEB/wQCMAAwggF9BgorBgEEAdZ5AgQCBIIBbQSCAWkBZwB1AO7N 0GTV2xrOxVy3nbTNE6Iyh0Z8vOzew1FIWUZxH7WbAAABjGnJk6gAAAQDAEYwRAIg AqYOtxbFag+jsRSnX/dVyPYh3qteOpCn4eUXkTUX7wICIHGOfZlQUBNuNCcjsT0k 13AL6OjiPe3j7WariS684kJJAHUASLDja9qmRzQP5WoC+p0w6xxSActW3SyB2bu/ qznYhHMAAAGMacmTzgAABAMARjBEAiAoUVfDJoMe8gK/rYTvjj4fHNPrrAnO8Mhy 1N6iGK6LngIgWDj6X03ESCYWTyyLhOXYgpLwUpcl38WkOi/uzE6nxyIAdwDatr9r P7W2Ip+bwrtca+hwkXFsu1GEhTS9pD0wSNf7qwAAAYxpyZO+AAAEAwBIMEYCIQC7 2UGBh6xrR1DM+MwbNwUmj+qaRwoZI6lVKGDz/azxoQIhAPUuVuuVTryPqzNoyUsw BVcP7GchjnjHo94vSzSkrOLHMA0GCSqGSIb3DQEBCwUAA4IBAQBV3uYeBy/SFjIo jSSno9bXqwEgbMI1drei/Z+3rC9gLxL3Vm/y38hDwfi6e/LETClQh0nmZJsfo4pR VND6cxwRTHgZhwA52xX0Filln2UrdaXvy+OfYeszTBsPsVO2GLqO83D28M+Tz8B4 yAILzjm/h7P3Y8abY8n+tsZgNVkcuSuOzBvGKUg2eJj8DAcPys6nsUcc3K4uJikO 7Cp6e7y/qs7Ok4lcuPhF+lxphmkSi7fxCke7/UhuMyT18IwFFadxyOq66r7FC3OI XNyLhcQ83lDeSX9//lxpLpbXsynPPDEH0ne3koVKJUaxq8GlUlmmdDv6SK72cnj7 zH1a4EjV -----END CERTIFICATE----- subject=CN = *.iot.us-east-1.amazonaws.com issuer=C = US, O = Amazon, CN = Amazon RSA 2048 M01

No client certificate CA names sent Client Certificate Types: RSA sign, DSA sign, ECDSA sign Requested Signature Algorithms: RSA+SHA256:RSA+SHA384:RSA+SHA512:RSA+SHA224:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ECDSA+SHA224:RSA+SHA1:ECDSA+SHA1 Shared Requested Signature Algorithms: RSA+SHA256:RSA+SHA384:RSA+SHA512:RSA+SHA224:ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:ECDSA+SHA224 Peer signing digest: SHA256 Peer signature type: RSA Server Temp Key: ECDH, prime256v1, 256 bits

SSL handshake has read 5491 bytes and written 521 bytes Verification: OK

New, TLSv1.2, Cipher is ECDHE-RSA-AES128-GCM-SHA256 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES128-GCM-SHA256 Session-ID: B3FBD172E1938A634ADF7444A01A8A0B6D324ED8F075BC84D707331F4607EFF1 Session-ID-ctx: Master-Key: 35336829FFFAC82FA9F5B6ECB531A280F2218B6769E33E4E65A7262B497A37D660F0CEDC7FC5605FC48EC4BDFE3CE5F7 PSK identity: None PSK identity hint: None SRP username: None Start Time: 1708361006 Timeout : 7200 (sec) Verify return code: 0 (ok) Extended master secret: yes

I got confused! I'm not big on SSL stuff, Im looking for a solution to unravel the issue,

[tronar]

Well, confusion is a required prereq for learning... Do you understand what are you trying to do with certs ? (hint: cross authentication) Do you understand how PKI works ? (hint: you need one or two common trusted points of reference, a.k.a. CA) Do you have a basic idea of pub/priv keys ? openssl s_client is telling you the cert chain that the server is using. Your "ca" cert has to be in that chain for the client to recognize the server as trusted/known. So either "Amazon Root CA 1" or "Starfield Services Root Certificate Authority - G2" should work.

[Scrts]

Are you using legacy certificates as I've told before? Does your AWS endpoint (I assume US east) support legacy certificate? Did you update your system clock?

AFAIK the SIM7xxx modules do not support non-legacy certificates. At least they did not work for me at all. Maybe new firmware changed that, but I'd try the proven method.

[tronar]

Hmm, and may be you need to specify SNI (+CSSLCFG: "sni",(0-5),)

[Aryan-Morteza]

Are you using legacy certificates as I've told before? Does your AWS endpoint (I assume US east) support legacy certificate? Did you update your system clock?

AFAIK the SIM7xxx modules do not support non-legacy certificates. At least they did not work for me at all. Maybe new firmware changed that, but I'd try the proven method.

I tried some certificate in this website: VeriSign Class 3 Public Primary G5 root CA certificate

Not work with Python SDK nor SIM7000 AT command. The Clock is updated since RPi in connected to internet. Today I'm going to try CA root from this website: https://www.amazontrust.com/repository/ and Cross-signed Amazon Root CA 1

Also, the firmware is updated.

[Scrts]

What does AT+CCLK? return? Should be current time.

I've used this legacy root CA certificate, which worked well. I've also sent you the same over email before: https://cacerts.digicert.com/pca3-g5.crt.pem

[tronar]

@Scrts He is using ignorertctime, time should not be an issue.

[Scrts]

@tronar, I was not aware that this is an option from AWS side... I've never tried, so cannot comment. Using NTP to sync time for the module is very easy - just need to know which time zone to select.

[Aryan-Morteza]

What does AT+CCLK? return? Should be current time.

I've used this legacy root CA certificate, which worked well. I've also sent you the same over email before: https://cacerts.digicert.com/pca3-g5.crt.pem

I tried to use it, but first, I have to embark on AWS IoT core certificates section.

[tronar]

@scrts It's not from AWS side, is for client side to decide if presented cert is valid "now". If you set "ignorertctime", then server cert time validity will not be checked. Also, TZ does not matter, it's only important if you want to display local time but irrelevant for cert validity checks.

[tronar]

@Aryan, what do you mean by "embark" ? Enroll ? In the page you are showing, pay attention: it's asking for a CSR, not for a certificate. You need to understand PKI first...

[Aryan-Morteza]

@aryan, what do you mean by "embark" ? Enroll ? In the page you are showing, pay attention: it's asking for a CSR, not for a certificate. You need to understand PKI first...

It means loading, Troner I know you have very good knowledge of SSH and SSL stuff. I'm not big on that, I have a little knowledge about the working flow of private key and public key.

I know there are three files from AWS IoT core, and for establishing a connection between RPI hat sim7000 and AWS IoT core I have to use them. I loaded them on my module, but I can't establish a connection. AT+SMCONN returns nothing or sometimes an error.

about the picture U right, my bad check this out: I admire your research attitude BTW I think the problem would be solved W/O gaining knowledge about the abbreviations you've told me.

Cheers

[Aryan-Morteza]

What does AT+CCLK? return? Should be current time.

I've used this legacy root CA certificate, which worked well. I've also sent you the same over email before: https://cacerts.digicert.com/pca3-g5.crt.pem

Yes! Thank you Mate, The thing is I have loaded it in my AWS IoT console and tried via Python SDK, but it seems it aint work. self._sslobj.do_handshake() ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992) I tried with SIM7000 to AT+SMCONN returns nothing, unfortunately.

[Scrts]

I've used mosquitto to debug and it worked before. "C:\Program Files\mosquitto\mosquitto_sub.exe" --cert certificate.crt --key private.key --cafile LegacyRoot.pem -h a1mfxzzzxxxyyy.iot.us-west-2.amazonaws.com -p 8883 -t "test"

AT+SMCONN returns nothing at all? Maybe it is trying a connection and it times out?

For the "certificate embark on AWS IoT" - I am not sure what are you doing and where are you doing this? Those CA certificates are already available for AWS - you do not have to do anything additional. If you go to AWS IoT -> Security -> Certificates, these are the ones that you create and upload to your device.

Also what policy did you assign to your own certificate? I suggest you make a really loose one for the beginning. I've used this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:*",
      "Resource": "*"
    }
  ]
}

[Aryan-Morteza]

I've used mosquitto to debug and it worked before. "C:\Program Files\mosquitto\mosquitto_sub.exe" --cert certificate.crt --key private.key --cafile LegacyRoot.pem -h a1mfxzzzxxxyyy.iot.us-west-2.amazonaws.com -p 8883 -t "test"

AT+SMCONN returns nothing at all? Maybe it is trying a connection and it times out?

For the "certificate embark on AWS IoT" - I am not sure what are you doing and where are you doing this? Those CA certificates are already available for AWS - you do not have to do anything additional. If you go to AWS IoT -> Security -> Certificates, these are the ones that you create and upload to your device.

Also what policy did you assign to your own certificate? I suggest you make a really loose one for the beginning. I've used this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:*",
      "Resource": "*"
    }
  ]
}

Hello,

I tried "C:\Program Files\mosquitto\mosquitto_sub.exe" --cert certificate.crt --key private.key --cafile LegacyRoot.pem -h a1mfxzzzxxxyyy.iot.us-west-2.amazonaws.com -p 8883 -t "test" with my certs and everything works.

When I'm using the legacy certificate using AT+command once I use SMSLL at command, module kinda reset and disconnect from port and then reconnect again: At+cnact? +CNACT: 1,"10.193.64.56"

OK AT+SMSSL=1,"AmazonRootCA1234.pem","certificate.crt" SMS Ready

DST: 0

*PSUTTZ: 24/02/27,10:31:35","+00",0 at+cnact? +CNACT: 0,"0.0.0.0"

OK

Also, I explored that Im using the client id from MQTT test client/Connection details/Client ID which is not correct and I must use the manage/things/name. I did amend and I'm still encountered with the issue above.

Additionally, I used the new certs they work with SMSSL but SMCONN outcome is error: AT+CNACT? +CNACT: 1,"10.193.128.11"

OK AT+CSSLCFG="ignorertctime",0,1 OK AT+CSSLCFG="convert",2,"AmazonRootCA1.pem" OK AT+CSSLCFG="convert",1,"certificate.crt","private.key" OK AT+CSSLCFG? OK AT+CSSLCFG="sslversion",0,3 OK AT+SMCONF=URL,*****.iot.us-east-1.amazonaws.com,8883 OK AT+SMCONF="CLIENTID","end1" OK AT+SMCONF="CLEANSS",0 OK AT+SMCONF="QOS",0 OK AT+SMCONF="TOPIC","sdk/test/python" OK AT+SMCONF="RETAIN",0 OK AT+SMCONF="KEEPTIME",60 OK AT+SMCONF? +SMCONF CLIENTID: "end1" URL: ****.iot.us-east-1.amazonaws.com:8883" KEEPTIME: 60 USERNAME: "" PASSWORD: "" CLEANSS: 0 QOS: 0 TOPIC: "sdk/test/python" MESSAGE: "" RETAIN: 0

OK AT+SMSSL=1,"AmazonRootCA1.pem","certificate.crt" OK AT+SMCONN ERROR

the policy also was and is the same like your suggestion.

based on this image it seems module partially connect with mqtt but something wrong with the module or aws. Also it seems with sim7600 you can connect to the AWS IoT Core without suffering.

[NavyaDevB]

Hi,

I am trying to connect my TTGO SIM7000G ESP32 Wrover-E to AWS IoT core using MQTT, in which I want to connect to internet through GSM, GPRS.

Can you share any documentation to upload the AWS generated certificates into the device and connect to AWS IoT core.

Thanks.