AWS IoT Core and MQTTnet not working with certs

Open

#1,730 opened on May 8, 2023 3 comments 0 reactions 0 assignees View on GitHub

bug

Dominant language: C#
Stars: 5.1k
Forks: 1.2k
PR merge metrics: No merged PRs in 30d

Description

Creating a separate issue for what we discovered about certs while debugging the custom authorizer:

https://github.com/dotnet/MQTTnet/issues/1729#issuecomment-1537521184

```cs
var caCrtKey = authorizer.Split(",");
var tempCaText = File.ReadAllText(caCrtKey[0]); // AmazonRootCA1.pem
var tempCrtText = File.ReadAllText(caCrtKey[1]); // certificate.pem.crt
var tempKeyText = File.ReadAllText(caCrtKey[2]); // private.pem.key
var tempCa = new X509Certificate2(X509Certificate2.CreateFromPem(tempCaText));
var tempCrt = X509Certificate2.CreateFromPem(tempCrtText, tempKeyText);
var ca = new X509Certificate2(tempCa.Export(X509ContentType.Pkcs12));
var cert = new X509Certificate2(tempCrt.Export(X509ContentType.Pkcs12));
optionsBuilder = optionsBuilder
.WithTls(
new MqttClientOptionsBuilderTlsParameters
{
UseTls = true,
ApplicationProtocols = new List { new("mqtt") },
Certificates = new X509Certificate[]
{
ca,
cert
},
}
);
```

original logs

```log
Running mqtt example application!

===================

Args Used

username: testid
password: testpassword
endpoint: a1jbgnrm1s76uh-ats.iot.us-east-1.amazonaws.com
rootTopic: open
authType: cert
authorizer: target/certs/AmazonRootCA1.pem,target/certs/certificate.pem.crt,target/certs/private.pem.key
transportImplementation: dotnet
transport: tcp

===================

[2023-05-07T19:16:06.8111116Z] [MqttNet] [1] [MqttClient] [Verbose]: Trying to connect with server 'a1jbgnrm1s76uh-ats.iot.us-east-1.amazonaws.com:443'
[2023-05-07T19:16:08.8696516Z] [MqttNet] [8] [MqttClient] [Verbose]: Connection with server established
[2023-05-07T19:16:08.8711942Z] [MqttNet] [6] [MqttClient] [Verbose]: Start receiving packets.
[2023-05-07T19:16:08.8780964Z] [MqttNet] [8] [MqttChannelAdapter] [Verbose]: TX (40 bytes) >>> Connect: [ClientId=testid] [Username=] [Password=] [KeepAlivePeriod=35] [CleanSession=True]
[2023-05-07T19:16:09.6253017Z] [MqttNet] [6] [MqttChannelAdapter] [Verbose]: RX (113 bytes) <<< ConnAck: [ReturnCode=ConnectionAccepted] [ReasonCode=NotAuthorized] [IsSessionPresent=False]
[2023-05-07T19:16:09.6314154Z] [MqttNet] [6] [MqttClient] [Verbose]: Disconnecting [Timeout=00:01:40]
[2023-05-07T19:16:09.6361834Z] [MqttNet] [6] [MqttClient] [Verbose]: Disconnected from adapter.
[2023-05-07T19:16:09.6383619Z] [MqttNet] [6] [MqttClient] [Info]: Disconnected.
[2023-05-07T19:16:09.6386716Z] [MqttNet] [6] [MqttClient] [Verbose]: Stopped receiving packets.
[2023-05-07T19:16:09.6310225Z] [MqttNet] [9] [MqttClient] [Error]: Error while connecting with server.
MQTTnet.Adapter.MqttConnectingFailedException: Connecting with MQTT server failed (NotAuthorized).
at MQTTnet.Client.MqttClient.AuthenticateAsync(MqttClientOptions options, CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 450
at MQTTnet.Client.MqttClient.ConnectInternal(CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 501
at MQTTnet.Client.MqttClient.ConnectAsync(MqttClientOptions options, CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 143
Unhandled exception. MQTTnet.Adapter.MqttConnectingFailedException: Connecting with MQTT server failed (NotAuthorized).
at MQTTnet.Client.MqttClient.AuthenticateAsync(MqttClientOptions options, CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 450
at MQTTnet.Client.MqttClient.ConnectInternal(CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 501
at MQTTnet.Client.MqttClient.ConnectAsync(MqttClientOptions options, CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 143
at MQTTnet.Client.MqttClient.ConnectAsync(MqttClientOptions options, CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 181
at Program.$(String[] args) in /home/tcroc/dev/aws-iot-custom-auth/aws-iot-custom-auth-mqttnet/Program.cs:line 109
at Program.(String[] args)
```

logs with fixed ConnAck

```log
Running mqtt example application!

===================

Args Used

===================

[2023-05-08T14:02:50.3208038Z] [MqttNet] [1] [MqttClient] [Verbose]: Trying to connect with server 'a1jbgnrm1s76uh-ats.iot.us-east-1.amazonaws.com:443'
[2023-05-08T14:02:50.6974135Z] [MqttNet] [6] [MqttClient] [Verbose]: Connection with server established
[2023-05-08T14:02:50.7044800Z] [MqttNet] [6] [MqttChannelAdapter] [Verbose]: TX (40 bytes) >>> Connect: [ClientId=testid] [Username=] [Password=] [KeepAlivePeriod=35] [CleanSession=True]
[2023-05-08T14:02:50.9013140Z] [MqttNet] [9] [MqttChannelAdapter] [Verbose]: RX (113 bytes) <<< ConnAck: [ReturnCode=ConnectionRefusedNotAuthorized] [ReasonCode=NotAuthorized] [IsSessionPresent=False]
[2023-05-08T14:02:50.9045582Z] [MqttNet] [9] [MqttClient] [Error]: Error while connecting with server
MQTTnet.Adapter.MqttConnectingFailedException: Connecting with MQTT server failed (NotAuthorized).
at MQTTnet.Client.MqttClient.Authenticate(MqttClientOptions options, CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 452
at MQTTnet.Client.MqttClient.ConnectInternal(CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 500
at MQTTnet.Client.MqttClient.ConnectAsync(MqttClientOptions options, CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 136
[2023-05-08T14:02:50.9184819Z] [MqttNet] [9] [MqttClient] [Verbose]: Disconnecting [Timeout=00:01:40]
[2023-05-08T14:02:50.9231366Z] [MqttNet] [9] [MqttClient] [Verbose]: Disconnected from adapter.
[2023-05-08T14:02:50.9250369Z] [MqttNet] [9] [MqttClient] [Info]: Disconnected.
Unhandled exception. MQTTnet.Adapter.MqttConnectingFailedException: Connecting with MQTT server failed (NotAuthorized).
at MQTTnet.Client.MqttClient.Authenticate(MqttClientOptions options, CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 452
at MQTTnet.Client.MqttClient.ConnectInternal(CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 500
at MQTTnet.Client.MqttClient.ConnectAsync(MqttClientOptions options, CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 136
at MQTTnet.Client.MqttClient.ConnectAsync(MqttClientOptions options, CancellationToken cancellationToken) in /_/Source/MQTTnet/Client/MqttClient.cs:line 175
at Program.$(String[] args) in /home/tcroc/dev/aws-iot-custom-auth/aws-iot-custom-auth-mqttnet/Program.cs:line 109
at Program.(String[] args)
```

I tried following this ticket here, but it didn't help: https://github.com/dotnet/MQTTnet/issues/1359

The issue can be reproduced by running this project over here:

https://github.com/TCROC/aws-iot-custom-auth.git

```
./create-cert.sh
```

^ This will use the aws cli to create certificates in your aws account and then download them to the working directory's ``target/certs`` folder.

```
./run-client-cert.sh
```

^ This will run the MQTTnet client and pass command line args to those certificates. Which should result in the following error:

```log
Running mqtt example application!

===================

Args Used

===================

Even though the certificates are currently configured with a permissive AWS IoT Core policy

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iot:*",
"Resource": "*"
}
]
}
```

NOTE: This issue is much less severity for me personally as I'm currently using custom authorizers instead of certificates. This was discovered while debugging the custom authorizer over here: https://github.com/dotnet/MQTTnet/issues/1729. Just adding for tracking purposes. I will help debug as we may want to use certificates in the future.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

AWS IoT Core and MQTTnet not working with certs

Description

Contributor guide

Assessment

Get new issues in your inbox