Hello , I am using X.509 certificates to authenticate devices to IoT hub using a MQTT client as shown in the code snippet below: TrustRootCER = "./DigiCertGlobalRootG2.crt" deviceCert = "./18B8C0FC73A9F382CE48FDAAB5A46E14.pem" deviceCertKey = "./device1.key" client.tls_set(ca_certs=TrustRootCER, certfile=deviceCert, keyfile=deviceCertKey, cert_reqs=ssl.CERT_REQUIRED, tls_version=ssl.PROTOCOL_TLSv1_2, ciphers=None) The client fails to connect with error below: context.load_verify_locations(ca_certs) ssl.SSLError: [X509: NO_CERTIFICATE_OR_CRL_FOUND] no certificate or crl found (_ssl.c:4154) Could you let me know if I am using the right certificate DigiCert Global Root G2 or if I am missing anything over here. Thanks

Hello @Arun Kumar, welcome to this moderated Azure community forum. The Azure IoT Hub uses a Digicert certificate to encrypt the transport of data (TLS). You can which certificate is used using: openssl s_client -connect [your iot hub].azure-devices.net:8883 For example, I check my personal IoT Hub: As you can see, the Digicert G2 is used. You can find the public cert file here . Please verify you have a legit certificate (don't just copy them directly from the internet :-) ). If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.

Using X.509 certificates to authenticate devices to IoT hub

Accepted answer

Sander van de Velde | MVP 33,051 Reputation points MVP

2024-05-06T18:43:35.0033333+00:00

Hello @Arun Kumar,

welcome to this moderated Azure community forum.

The Azure IoT Hub uses a Digicert certificate to encrypt the transport of data (TLS).

You can which certificate is used using:

openssl s_client -connect [your iot hub].azure-devices.net:8883

For example, I check my personal IoT Hub:

As you can see, the Digicert G2 is used.

You can find the public cert file here. Please verify you have a legit certificate (don't just copy them directly from the internet :-) ).

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.
Please sign in to rate this answer.
Arun Kumar 40 Reputation points

2024-05-07T07:30:13.76+00:00

Hi Sander,
Thanks
I am getting a different error now after using the right certificate.Here is the complete code.Can you pls take a a look at the code and let me know what could be wrong.I have generated the certs for the device by following the documentation at

https://learn.microsoft.com/en-us/azure/iot-hub/tutorial-x509-test-certs?tabs=linux

Error: "Connected with result: Not authorized"

import paho.mqtt.client as mqtt import ssl import time import paho.mqtt.client as mqtt TrustRootCER = "./DigiCertGlobalRootG2.crt.pem" deviceCert = "./E4A8DFC31411.pem" deviceCertKey = "./E4A8DFC31411.key" HubName = "myhub.azure-devices.net" devicename = "E4A8DFC31411" def on_connect(client, userdata, flags, rc, properties): print ("Connected with result: " + str(rc)) client.subscribe("devices/" + devicename + "/messages/devicebound/#") def on_disconnect(client, userdata, rc): print ("Disconnected with result code: " + str(rc)) def on_message(client, userdata, msg): print (msg.topic+" "+str(msg.payload)) client.publish("devices/" + devicename + "/messages/events/", "{id=1}", qos=1) def on_publish(client, userdata, mid): print ("Sent message") client = mqtt.Client(mqtt.CallbackAPIVersion.VERSION2) client.on_connect = on_connect #client.on_disconnect = on_disconnect client.on_message = on_message client.on_publish = on_publish client.username_pw_set(username=HubName + "/" + devicename, password=None) client.tls_set(ca_certs=TrustRootCER, certfile=deviceCert, keyfile=deviceCertKey, cert_reqs=ssl.CERT_REQUIRED, tls_version=ssl.PROTOCOL_TLSv1_2, ciphers=None) client.connect(HubName, port=8883) client.publish("devices/" + devicename + "/messages/events/", "{id=SG MQTT Test}", qos=1) client.loop_forever()

Sander van de Velde | MVP 33,051 Reputation points MVP

2024-05-07T11:14:06.3566667+00:00

Hello Arun Kumar

Sorry, I'm not sufficient enough in Python to check the issue.

Please check if you can connect with another device first, using a connection string. This tests the connection itself.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Using X.509 certificates to authenticate devices to IoT hub

0 additional answers

Your answer