tedge-mapper c8y http proxy ignores c8y.root_path_cert

[cpoder]

Describe the bug When connecting to a Cumulocity instance that uses self signed certificate (typically Cumulocity Edge), one has to update the c8y.root_path_cert to point to the server instance certificate. The tedge-mapper doesn't seem to take this parameter into account as it will still fail to connect to Cumulocity with the following error: Error: FromHttpError(HyperError(hyper::Error(Connect, Custom { kind: Other, error: Custom { kind: InvalidData, error: InvalidCertificate(UnknownIssuer) } })))

To Reproduce Try to connect to Cumulocity Thick Edge instance that uses a self signed certificate.

Expected behavior Thin Edge should connect to the Thick Edge instance and tedge-mapper should appear as green in the services tab of the device in Cumulocity.

Environment (please complete the following information):

• thin-edge.io version 0.13.1
• Cumulocity Edge 10.15

[didier-wenzek]

It's not enough to tell where is the certificate to be used to authenticate c8y, this certificate has to be trusted. Here is the documentation to do so: https://thin-edge.github.io/thin-edge.io/operate/security/add_self_signed_trusted/.

[cpoder]

Thanks Didier, I didn't think using ca-certificates was mandatory. The doc is a bit confusing about that part as https://thin-edge.github.io/thin-edge.io/start/connect-c8y/#connecting-to-cumulocity-server-signed-with-self-signed-certificate seems to tell that updating c8y.root_path_cert is enough, so it might be good to update that part of the documentation. I was even more confused since it was working for MQTTS but not for HTTPS. I should have thought to use ca-certificates though as it is usually the way to go :)

[reubenmiller]

@cpoder Though just for clarification (and for other users). Can you please list the actual command that you ran? As "connect to Thick Edge" is a bit vague.

[cpoder]

I should have mentioned that using ca-certificates it is now working perfectly. Here are the steps to connect Thin Edge to Cumulocity Thick Edge:

• First, download the server certificate using your browser (don't use the certificate given by R&D to install Thick Edge, as it is not the server root certificate!)
• Follow the steps given here to make the certificate trusted by Thin Edge: https://thin-edge.github.io/thin-edge.io/operate/security/add_self_signed_trusted/#debianubunturaspberrypi-os
• Update your /etc/hosts with the address and IP of your Thick Edge instance if required
• Update Thin Edge c8y url to point to your Thick Edge address you just put in /etc/hosts (don't use the IP, Thin Edge will not accept it): sudo tedge config set c8y.base_url
• Unlike what is written here: https://thin-edge.github.io/thin-edge.io/start/connect-c8y/#connecting-to-cumulocity-server-signed-with-self-signed-certificate don't change the c8y.root_path_cert parameter, you don't need to do that if you used ca-certificates
• Just start Thin Edge: sudo tedge connect c8y, it should all work fine