aws-iot-device-sdk-python-v2: AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE on 1.0.6 (awscrt 0.5.13)
- I’ve searched for previous similar issues and didn’t find any solution
Describe the bug
After upgrading my installation to awsiotsdk-1.0.6 it stopped working with awscrt failing to authorize with aws’ backend. Might be connected with awscrt upgrade to 0.5.13.
SDK version number awsiotsdk-1.0.6
Platform/OS/Device rpi3b+
To Reproduce (observed behavior)
Upgrade awsiotsdk to version 1.0.6.
Expected behavior Should work as expected.
Logs/output
Apr 15 06:55:01 raspberrypi python3[581]: Connecting to something-east-1.amazonaws.com with client ID 'foo-bar-baz'...
Apr 15 06:55:01 raspberrypi python3[581]: Traceback (most recent call last):
Apr 15 06:55:01 raspberrypi python3[581]: File "app.py", line 86, in <module>
Apr 15 06:55:01 raspberrypi python3[581]: connect_future.result()
Apr 15 06:55:01 raspberrypi python3[581]: File "/usr/lib/python3.7/concurrent/futures/_base.py", line 432, in result
Apr 15 06:55:01 raspberrypi python3[581]: return self.__get_result()
Apr 15 06:55:01 raspberrypi python3[581]: File "/usr/lib/python3.7/concurrent/futures/_base.py", line 384, in __get_result
Apr 15 06:55:01 raspberrypi python3[581]: raise self._exception
Apr 15 06:55:01 raspberrypi python3[581]: awscrt.exceptions.AwsCrtError: AwsCrtError(name='AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE', message='TLS (SSL) negotiation failed', code=1029)
Apr 15 06:55:01 raspberrypi systemd[1]: app.service: Main process exited, code=exited, status=1/FAILURE
About this issue
- Original URL
- State: closed
- Created 4 years ago
- Comments: 17 (11 by maintainers)
@JonathanHenson I was using the old endpoint (
<endpoint-id>.iot.us-east-1.amazonaws.com), I switched to the ATS one (<endpoint-id>-ats.iot.us-east-1.amazonaws.com) and now it works. Thanks for your help!Thank you Mario for sharing the link to that post here. Again: https://aws.amazon.com/blogs/iot/aws-iot-core-ats-endpoints/
The default configuration for V2 device SDKs will no longer work with the old non-ATS endpoints. Run
aws --region <region> iot describe-endpoint --endpoint-type "iot:Data-ATS"to get the ATS endpoint.@mkozjak I did and the problem was resolved
Hi there, I was stuck with this error for 2 hours when migrate from old sdk to v2(v1.5.0) even I tried on multiple environment both Windows10, Ubuntu18 or MacOS.
old sdk example
basicPubSub.pyjust works with my key, certificate & rootCA1 But new sdk examplepubsub.pyjust does not work with same keys & policyI have to input the port so that it can work, hope it can also help you.
Regards, Justin
Hey @JonathanHenson @graebm if this is using the same S2N stack as the CPPv2 SDK, I observed that in the latest SDK version v1.5.5 on my system, this also fails because the device advertises support for ECDSA, but the S2N stack only supports RSA, and during negotiation ECDSA is chosen. adolfogc’s log looks the same as mine during that particular failure mode.
I tried to pull in the version of S2N on master, which is supposed to support ECDSA, but at least on my system this also failed, because it would somehow try to use the ECDSA key from the RSA code. I was planning to fix that and submit a pull-request to S2N, but haven’t gotten around to it.
I’m currently using v1.5.1 of the CPPv2 SDK which negotiates to always use RSA during the challenge step
@graebm I just tested again. Version 1.0.5 runs fine. The problem occurs when using version 1.0.6. I’m using a certificate signed with that CA you mention (not the deprecated one).
This test was run using
pubsub.pywith--root-cain a Docker container.This is an excerpt of the debug output: