ST意法半导体
直播中

马聪

7年用户 204经验值
私信 关注
[问答]

SPWF04SA证书错误

嗨,
我正在尝试与AWS IoT端点建立具有相互TLS身份验证的MQTT连接。
我使用的命令是
AT + S.MQTTCONN =♯♯♯♯♯.iot.eu-西1.amazonaws.com,443,,2 ,,,,,,,,
(出于安全原因,我只部分粘贴主机名)。
验证服务器端证书似乎存在一些问题,因为我们总是收到以下错误:
AT-S.Certificate错误:11
根据UM2114,错误意味着,但我无法理解哪个证书(客户端,服务器或ca)失败。
我已经有了
根据AN4963(和文件)中指定的约定,将AWS IoT根证书,客户端证书和客户端私钥分配到文件系统中。
值得一提的是,即使没有加载证书,仍会显示相同的错误;这让我相信在解析服务器证书时应该发生失败。
问题是由于我的错误使用造成的吗?或者这是模块的失败?

附件我发送端点发送的证书链和带有AT + S.STS结果的屏幕截图,希望它们可能有用。
非常感谢

#spwf04s #mqtt #iot #aws

以上来自于谷歌翻译


以下为原文





Hi,

I am attempting to establish an MQTT connection with mutual TLS authentication to a AWS IoT Endpoint.

The command I use is
AT+S.MQTTCONN=♯♯♯♯♯.iot.eu-west-1.amazonaws.com,443,,2,,,,,,,,
(I only paste the hostname partially for security reasons).
There seems to be some issue validating the server-side certificate, since we always receive the following error:

AT-S.Certificate Error:11

According to UM2114, the error means , but I fail to understand which certificate (client, server or ca) is failing.

I have already a
dded the AWS IoT root certificate, client certificate and client private key into the filesystem, according to the convention specified in AN4963 (,  and  files).

It may be worth mentioning that even if no certificates are loaded, the same error is still shown; this leads me to believe the failure should occur when parsing the server certificate.

Is the problem caused by my wrong usage? Or is it a failure of the module?

?

Attached I send the certificate chain the endpoint sends and a screenshot with the result of AT+S.STS, hoping they may be useful.

Many thanks

#spwf04s #mqtt #iot #aws

回帖(3)

宁晓蕾

2019-2-27 06:41:51
你能否在这个阶段将证书加载到flash中?这样,主题密钥id由模块本身管理。
一旦解决,我们就可以回到文件系统。
请附加所有TLSCERT和MQTT命令的输出。

以上来自于谷歌翻译


以下为原文





Can you please load certs into flash at this stage? This way the subject key id is managed by module itself.

Once solved, we can move back to filesystem.

Please attach the output for all TLSCERT and MQTT commands.
举报

马聪

2019-2-27 06:55:16
嗨Gerardo,
感谢您的快速回复。
以下是您提到的命令和输出的屏幕截图。
如果您需要更多信息,请告诉我。
P.S。:如果它可能以某种方式影响结果,我应该注意我使用而不是推荐作为我的选择应用程序,以便通过USB建立串行连接。
证书,私钥(全部采用PEM格式)和subjectId通过命令'何时挂起数据加载。

以上来自于谷歌翻译


以下为原文




Hi Gerardo,
Thanks for the quick reply.
Here are screenshots of the commands and outputs you mentioned.
Please do tell me when you need any more information.
P.S.: In case it may somehow affect the result, I should note I'm using  in instead of recommended  as my application of choice in order to establish the Serial connection via USB.
The certificates, private key (all in PEM format) and subjectId are loaded via the command ' when  is pending data.
举报

宁晓蕾

2019-2-27 07:06:37
经过一番调查,我们发现了这个问题。当前的TLS实现无法使用混合ECC和RSA证书。使用(此处)根CA由RSA签名,而证书基于ECDSA。
谢谢你抓住它。已经向开发团队发出信号,并希望将在下一个FW版本中得到解决。同时,请尝试使用同类证书链。

以上来自于谷歌翻译


以下为原文




After some investigations, we found the issue. Current TLS implementation is not able to use mixed ECC and RSA certificates. Used (here) root CA is signed by RSA, while certificate is ECDSA based.
Thanks for catching it. Has been signaled to developers team, and hopefully will be solved into next FW revision. In the meanwhile, please try to used an homogeneous certificates chain.
举报

更多回帖

发帖
×
20
完善资料,
赚取积分