使用IoT WebSocket : CERTIFICATE_VERIFY_FAILED的AWS MQTT

Question

如本IoT所述，我试图使用链接脚本来设置AWS 链接。

我能够在AWS IoT MQTT上连接，而不需要WebSocket (使用x.509证书)。

# creates the AWS IoT 
def createIoT(): 
   iot = AWSIoTMQTTShadowClient('AWSHome') 
   # update this with your own endpoint from the IOT dashboard 
   iot.configureEndpoint('allj.iot.reg.amazonaws.com', 443) 
   iot.configureCredentials('rootCA','private.key','certificate.crt') 
   iot.configureConnectDisconnectTimeout(10)  # 10 sec 
   iot.configureMQTTOperationTimeout(5)  # 5 sec 
   iot.connect() 
   return 

但是，当我试图在AWS IoT MQTT上与WebSocket连接时，我会得到以下错误：

使用通过运行以下命令生成的证书：惠特

# creates the AWS IoT 
def createIoT(): 
   iot = AWSIoTMQTTShadowClient('AWSHome') 
   # update this with your own endpoint from the IOT dashboard 
   iot.configureEndpoint('asdasd.reg.amazonaws.com', 443) 
   iot.configureCredentials('VeriSign-Class%203-Public-Primary-Certification-Authority-G5.pem') 
   iot.configureConnectDisconnectTimeout(10)  # 10 sec 
   iot.configureMQTTOperationTimeout(5)  # 5 sec 
   iot.connect() 
   return 

错误：

    Traceback (most recent call last): 
    File "./awshome.py", line 60, in <module> iot = createIoT() 
    File "./awshome.py", line 50, in createIoT iot.connect() File "/home/pi/.local/lib/python2.7/site-packages/AWSIoTPythonSDK/MQTTLib.py", line 1216, in connect return         
    self._AWSIoTMQTTClient.connect(keepAliveIntervalSecond) 
    File "/home/pi/.local/lib/python2.7/site-packages/AWSIoTPythonSDK/MQTTLib.py", line 485, in connect return self._mqtt_core.connect(keepAliveIntervalSecond) 
    File "/home/pi/.local/lib/python2.7/site-packages/AWSIoTPythonSDK/core/protocol/mqtt_core.py", line 192, in connect self.connect_async(keep_alive_sec, self._create_blocking_ack_callback(event)) 
    File "/home/pi/.local/lib/python2.7/site-packages/AWSIoTPythonSDK/core/protocol/mqtt_core.py", line 219, in connect_async 
    raise e 
    ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)ssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)

Answer 1

自2018年5月以来，AWS的IoT核心的端点和证书都发生了变化。

简而言之，你需要：

1. 将端点更改为a1am7bjirugllj-ats.iot.us-east-1.amazonaws.com (注意-ats)
2. 使用一个AWS根CA (https://www.amazontrust.com/repository/AmazonRootCA1.pem)

详细信息：https://aws.amazon.com/blogs/iot/aws-iot-core-ats-endpoints/

Answer 2

可能是您有自签名证书，或者发生了使证书无效的其他情况。问题是你想实现什么..。如果要让它发挥作用的话：

import ssl

ssl._create_default_https_context = ssl._create_unverified_context

这个解决方案非常难看，这里和这里 --您有更广泛的解释。