RuntimeError: 1038 (AWS_IO_FILE_VALIDATION_FAILURE) with JITP and OpenSSL certificates

[Pandahkiin]

Confirm by changing [ ] to [x] below:

• I've searched for previous similar issues and didn't find any solution

Platform/OS/Device
What are you running the sdk on?
Windows 11
SDK v2 release 1.10
OpenSSL 3.0.1

Description

Greetings,

I am getting a RuntimeError: 1038 (AWS_IO_FILE_VALIDATION_FAILURE) when I try to connect to AWS with my own generated certificates, keys and CA. I am setting up a JITP environment following this procedure.
It seems that the format of my certificates is incorrect, because when I use the certificates generated by AWS itself, it works perfectly. Moreover, when I was first developing with the v1 SDK (the one in a .zip file when following the "Quick Start" part of AWS IoT Core), I didn't have this problem and my certificates were accepted.
My policy on IoT Core basically allows every action on every resource.
I also tried to run the PubSub example by giving all required arguments, but I still have the same problem.

So I was wondering :

• What is the expected certificate format in the SDK ?
• How do I need to change in my OpenSSL commands to make it work ?

Thank you very much for your answer !

Output

Traceback (most recent call last):
File "C:\Python310\lib\site-packages\awsiot\mqtt_connection_builder.py", line 236, in mtls_from_path
    return _builder(tls_ctx_options, **kwargs)
  File "C:\Python310\lib\site-packages\awsiot\mqtt_connection_builder.py", line 194, in _builder
    tls_ctx = awscrt.io.ClientTlsContext(tls_ctx_options)      
  File "C:\Python310\lib\site-packages\awscrt\io.py", line 564, in __init__
    self._binding = _awscrt.client_tls_ctx_new(
RuntimeError: 1038 (AWS_IO_FILE_VALIDATION_FAILURE): A file was read and the input did not match the expected value

[jmklix]

We recently fixed a problem with concatenated certs, so that shouldn't be an issue since you seem to be using the latest version. Can you double check and make sure that you are using the correct IoT thing and that the certificate is showing up in the AWS Console?

[Pandahkiin]

I checked my certificates and everything is in order, as well as my policies. I also check my SDK version but it also seems up to date according to pip. Moreover, I used a basic mosquitto_pub command to establish a connection and it works fine, referring to the 'Activity' tab of the specific thing I use.

Pip output :

Requirement already satisfied: awsiotsdk in c:\python310\lib\site-packages (1.10.0)
Requirement already satisfied: awscrt==0.13.6 in c:\python310\lib\site-packages (from awsiotsdk) (0.13.6)

Mosquitto_pub output :

Client Dummy sending CONNECT
Client Dummy received CONNACK (0)
Client Dummy sending PUBLISH (d0, q1, r0, m1, 'Dummy/test', ... (5 bytes))
Client Dummy received PUBACK (Mid: 1, RC:0)
Client Dummy sending DISCONNECT

IoT Console Activity output :

Connected
$aws/events/presence/connected/Dummy

April 04, 2022, 10:15:17 (UTC+0200)

[Pandahkiin]

Hello,

I have recently set up a new dev environment running this time on Linux and everything runs perfectly fine, without any change ! However, when switching back to Windows, the problem comes back.
So it seems like the issue comes from the way the Windows part reads certificates.

I should be able to keep going for now, thank you for your attention !

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.