Unable to connect to Azure IoT hub due to error "[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate."

Question

I am using azure-iot-device python SDK for connecting to Azure IoT Hub. My organization network is beyond Zscaler. When I am disabling Zscaler, I am able to connect to IoT sucessfully. But when I am enabling Zscaler, I am getting below error

Could you please help me to get it working when Zscaler is active (i.e. as I can not disabled Zscaler )

I can see some solution provided for Azure IoT edge but I am unable to find any link which can help to resolve issue encountered in azure-iot-device python SDK

Answer 1

Hello @Chetan Vijay Gomase ,

I have no direct experience with ZScaler but it seems it prevents communication either to the IoT Hub or over the protocol of use (MQTT or AMQP).

Regarding IoT Hub, perhaps you can check if your IoT Hub is black or whitelisted.

Regarding the protocol, Azure IoT also supports MQTT over Websockets.

Check out this blog post about IoT Hub communication with Python.

It comes with this GitHub example where communication over websockets is enabled.

---

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.

Answer 2

Hi @Chetan Vijay Gomase Greetings! Welcome to Microsoft Q&A forum. Thank you for posting this question here.

As @Sander van de Velde pointed, Zscaler is blocking the communication over MQTT protocol. A similar question has been addressed in the past. Please find more details on the solution proposed through the link Defining a Proxy used by the Azure IoT Hub Client (Python) As the solution points, you would need to make additional configurations on Zscaler to enable MQTT/AMQP communications to enable the Python SDK to communicate with Azure IoT Hub. For additional guidance on how to enable these settings, you can reach out to Zscaler support forum

Hope this answers your questions. Please let us know if you need any additional assistance on this.

Update

Adding Zscaler root certificate as a trusted certificate in the system helped resolve the issue.

---

If the response helped, please do click Accept Answer and Yes for the answer provided. Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.