How to set the certificate final location when Provisioning-EflowVm (DPS)?

Kenia Sanchez 20

Hi,

When I run the command Provision-EflowVm (as the example), I set the corresponding scopeId and the paths for the certificates in my local machine. (C:)

  Provision-EflowVm -provisioningType DpsX509 -scopeId 0ne00000000 -registrationId myeflowdevice -identityCertPath "C:\certs\iot-edge-device-identity-myeflowdevice.cert.pem" -identityPrivKeyPath "C:\private\iot-edge-device-identity-myeflowdevice.key.pem"

After that, the config.toml is filled with the provisioning and provisioning.attestation information.

[provisioning]

source = "dps"

global_endpoint = "https://global.azure-devices-provisioning.net"

id_scope = "0ne00000000"

[provisioning.attestation]

method = "x509"

*# registration_id = "

AshokPeddakotla-MSFT 34,611 Reputation points

2023-10-06T05:10:32.2633333+00:00

Kenia Sanchez Greetings!

Which documentation are you following for the steps?

Did you check the Configure IoT Edge device settings documentation already?
Kenia Sanchez 20 Reputation points

2023-10-06T15:18:12.39+00:00

Hello! I'm following this one,

https://learn.microsoft.com/en-us/azure/iot-edge/how-to-provision-devices-at-scale-linux-on-windows-x509?view=iotedge-1.4&tabs=individual-enrollment#provision-the-device-with-its-cloud-identity

It looks like my question is missing information.

The config.toml is filled out with the url's for the certificate location (inside the vm)

How is that url set? or how can I change it without opening the file?
Kenia Sanchez 20 Reputation points

2023-10-06T15:21:33.6433333+00:00

Hi, It looks like my question wasn't complete.

In the config file, there are the URL's for the cert and private key (located inside the vm).

Is there a way to change those paths without openning the config.toml file?
AshokPeddakotla-MSFT 34,611 Reputation points

2023-10-11T15:51:43.1133333+00:00

Kenia Sanchez Thanks for sharing additional information. I'm enquiring at the moment and will share my findings as earliest. Appreciate your time and patience.
LeelaRajeshSayana-MSFT 15,886 Reputation points Microsoft Employee

2023-10-12T00:07:45.4966667+00:00
Hi @Anonymous It could be possible that the Powershell command Provision-EflowVm is still updating the properties to /etc/iotedge/config.yaml and an underlying process could be pushing few updates to /etc/aziot/config.toml file. I appreciate it if you can review the config.yaml file and confirm that it has the correct parameters pointing to the certificate location.

Please back up your config.toml file before proceeding with the below changes.

If you notice the above scenario, you may use the command sudo iotedge config import --force to update the contents on the config.toml file based on the details you have in config.yaml file. Investigate the config.toml file now and see if the path has been updated.

Once you verify the contents, run the following command to apply the new configuration.

sudo iotedge config apply -c '/etc/aziot/config.toml'

Please let us know if this is helpful.
Kenia Sanchez 20 Reputation points

2023-10-12T19:03:17.4966667+00:00

Hi @LeelaRajeshSayana-MSFT I don't even have /etc/iotedge/, neither the config.yaml file. I'm using EFLOW 1.4.9, I thought the .toml file was the only thing required
LeelaRajeshSayana-MSFT 15,886 Reputation points Microsoft Employee

2023-10-12T20:05:00.3033333+00:00

Hi @Anonymous Your understanding is correct. The latest versions of Eflow would write the configurations to config.toml However, I have seen scenarios where when we try to upgrade/reprovision EflowVM on windows machine where older versions of EflowVM 1.2 were originally set up, the configurations can be found in the config.yaml file too. I understand that is not the case here.

Looks like this is a missing feature with the implementation. We will work on this internally and keep you posted on our findings. I understand that this situation may have caused some inconvenience, and I want to express my gratitude for your efforts and patience in handling it. Thank you.

1 answer

LeelaRajeshSayana-MSFT 15,886 Reputation points Microsoft Employee

2024-01-08T21:43:48.33+00:00

Hi @Kenia Sanchez Greetings! Apologies for the delayed feedback on this. I would like to inform you that with the current implementation of the product, the config.toml file does not automatically include the details of the certs.

Our product team is currently working fixing this issue in a future release which is targeted to release at the end of January/beginning of February. I will update the thread again once the fix is released.

Hope this helps! I understand that this situation may have caused some inconvenience, and I want to express my gratitude for your efforts and patience in handling it.

If the response helped, please do click Accept Answer and Yes for the answer provided. Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to set the certificate final location when Provisioning-EflowVm (DPS)?

1 answer

Your answer