How do I check Quickstart CA development certificate expiration on IoT Edge 1.4?

Question

How do I check Quickstart CA development certificate expiration on IoT Edge 1.4?

Sai Allu 20 Microsoft Employee

Good morning,

I had a couple of small questions about IoT Edge. Could you please help me?

For an Azure VM running Edge 1.4 using Quickstart CA Development certificates, how can I check when the TLS cert (development cert) will expire? In Edge 1.1, "iotedge check" would display the expiration date, but I don't see that in Edge 1.4.
In Edge 1.1, when "iotedge check" said that a development cert would expire on June 4th, we actually wouldn't notice any problem until June 18th (roughly 14 days or 2 weeks later). Why is that? Did the cert really expire on June 4th or it was still valid until June 18th?

LeelaRajeshSayana-MSFT 17,871 Reputation points Moderator

2023-10-12T17:21:31.7133333+00:00

Hi @Sai Allu Greetings! I am following up to see if you got a chance to review the below response. Please let us know if you have any additional questions or need further assistance.

If the response helped, please do click Accept Answer and Yes for the answer provided. Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.
Sai Allu 20 Reputation points Microsoft Employee

2023-10-12T18:39:13.9066667+00:00

Yes this was super helpful, thank you guys!

Answer accepted by question author

0 additional answers

Your answer

LeelaRajeshSayana-MSFT 17,871 Reputation points Moderator

2023-10-12T17:21:31.7133333+00:00

Hi @Sai Allu Greetings! I am following up to see if you got a chance to review the below response. Please let us know if you have any additional questions or need further assistance.

If the response helped, please do click Accept Answer and Yes for the answer provided. Doing so would help other community members with similar issue identify the solution. I highly appreciate your contribution to the community.
Sai Allu 20 Reputation points Microsoft Employee

2023-10-12T18:39:13.9066667+00:00

Yes this was super helpful, thank you guys!

Answer 1

Sander van de Velde | MVP 37,066 MVP

Hello @Sai Allu,

welcome to this moderated Azure forum.

the Azure IoT Edge runtime uses a TLS certificate for securing internal communication.

If you restart the Azure IoT Edge edgeAgent module, and check the logging:

sudo iotedge logs -f edgeAgent

At the start of the new logging session, you will see a line containing the expiration time of the current certificate.

Once the certificate expires, the communication stops.

Luckily, if you still use that development certificate, a new certificate will be created (for another 90 days), and communication will resume again. Until it expires again.

It's recommended to replace the dev certificate with a custom certificate for improved security and 24/7 operation. There is an alternative solution by just editing the config.toml file. Check the side note on this blog post for details.

The case you experienced with 1.1 is not a common behavior.

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.

Sai Allu 20 Reputation points Microsoft Employee

2023-10-10T19:01:15.38+00:00

Hello! Thank you so much @Sander van de Velde , just had one follow up question. Let's say my IoT TLS certificate is created on October 10th and expires on January 10th (90 days). If I restart IoT Edge on October 20th (10 days after certificate creation), will IoT Edge generate a new certificate or since the previous one isn't expired yet will it do nothing? Because on Edge 1.1, I've seen that if I restart before the previous certificate expires, IoT Edge doesn't do any renewal, it keeps using the old certificate.
Sander van de Velde | MVP 37,066 Reputation points MVP

2023-10-10T20:50:12.35+00:00

Hello @Sai Allu,

I looked it up in the documentation, a quickstart edge CA certificate can be renewed earlier:

By default, IoT Edge automatically renews the quickstart Edge CA certificate when at 80% of the certificate lifetime.

Renewal of the certificate can result in restarting modules.

By restarting the edge device in that grey zone, there is a chance the quickstart edge CA certificate is renewed.

As I said, it's wise to step away from the quickstart edge CA certificate if you want to guarantee 24/7 uptime!

If you roll out your own certificates, you are in full control. You can pick the perfect moment to renew it yourself.

Ay to set the quickstart edge CA certificate expiration time to 10 years in the future.

It's up to you.

Share via

How do I check Quickstart CA development certificate expiration on IoT Edge 1.4?

0 additional answers

Your answer