Greengrass support

[amitguptaRean]

We got sample/shadow_sync working for IoT Core
Will the same sample work for Greengrass core if we change the endpoint ?

Thanks
Amit Gupta
Hitachi Vantara

[dislogical]

It should! Did you run into any issues when you tried it?

[ravichandhraRean]

Hi @ColdenCullen, @JonathanHenson

1. Using Port: 443 and ALPN check enabled

if (Io::TlsContextOptions::IsAlpnSupported()) 
	{
		/*
		 * Use ALPN to negotiate the mqtt protocol on a normal
		 * TLS port if possible.
		 */
		tlsCtxOptions.SetAlpnList("x-amzn-mqtt-ca");
		port = 443;
	}

When we try to connect to Greengrass core we are getting this error

Connection failed with error aws-c-io: AWS_IO_SOCKET_CONNECTION_REFUSED, socket connection refused.

2. Using Port: 8833 and ALPN check disabled

we are getting this error
Connection failed with error aws-c-io: AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE, TLS (SSL) negotiation failed

is this new aws-iot-device-sdk-cppv2 will work with Greengrass ?

Thank you.

Regards,
Ravichandhra Palla
Hitachi Vantara

[Kevin-Tacheny]

I was getting the same error Ravi was getting
Connection failed with error aws-c-io: AWS_IO_SOCKET_CONNECTION_REFUSED, socket connection refused

But noticed that port 8883 being used on the Greengrass client. So I changed the port to 8883 and removed the alpn check (this changes it back to 443) and now I get

Connection failed with error aws-c-io: AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE, TLS (SSL) negotiation failed

[JonathanHenson]

How is the cert for the device deployed? Also, are you setting the correct CA for the device?

[Kevin-Tacheny]

We did and scp for the keys and then used the cli to get the group ca From: Jonathan M. Henson <notifications@github.com> Sent: Wednesday, March 27, 2019 9:50 AM To: awslabs/aws-iot-device-sdk-cpp-v2 <aws-iot-device-sdk-cpp-v2@noreply.github.com> Cc: Kevin Tacheny <kevin.tacheny@hitachivantara.com>; Comment <comment@noreply.github.com> Subject: Re: [awslabs/aws-iot-device-sdk-cpp-v2] Greengrass support (#8) ***** EXTERNAL EMAIL ***** How is the cert for the device deployed? Also, are you setting the correct CA for the device? — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fawslabs%2Faws-iot-device-sdk-cpp-v2%2Fissues%2F8%23issuecomment-477191085&data=01%7C01%7Ckevin.tacheny%40hitachivantara.com%7C0f3bf5f5e91241a6c95508d6b2c38843%7C18791e1761594f52a8d4de814ca8284a%7C0&sdata=cK7n01PXVZBVZHA%2F8DIOzQSEj8xVv3iwZb6S8kG6kdQ%3D&reserved=0>, or mute the thread<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAtkzmh3eHyj1CMh6hcbWXfUIR6Z7qJHbks5va4UqgaJpZM4bj6Ls&data=01%7C01%7Ckevin.tacheny%40hitachivantara.com%7C0f3bf5f5e91241a6c95508d6b2c38843%7C18791e1761594f52a8d4de814ca8284a%7C0&sdata=A08M8ZrJAm8Wolo%2BzefKX9o1zvRq8D2ZbXozQTctRlc%3D&reserved=0>.

[ravichandhraRean]

@JonathanHenson

yes we deployed the device certs using SCP,

1. pem certificate (.pem format)
2. private key
3. group root CA (downloaded using aws greengrass cli commands) (.pem format)

[JonathanHenson]

okay, this sounds PKI related. We haven't added the logging bindings yet to the crt, but you can still enable it:

Could you do the following:
https://github.com/awslabs/aws-c-http/blob/master/bin/elasticurl/main.c#L434

and
https://github.com/awslabs/aws-c-http/blob/master/bin/elasticurl/main.c#L454

Before you run the rest of the app (above the other stuff in your main function)

And post the logs. For expedience, use a TRACE level for the logs.

[ravichandhraRean]

@JonathanHenson ,

I am testing the shadow_sync sample, how to do modifications to that to produce the logs,

1. aws_load_error_strings(); is ok when adding,

2. but when adding aws_io_load_log_subject_strings(); i am getting compilation error (I think i need add aws-c-io lib to shadow_sync)

3. how to use TRACE level for the logs in shadow_sync sample

Thank you.

[JonathanHenson]

You probably just need the header files, these dependencies get exported automatically by the SDK.

Have you included:
#include <aws/io/logging.h>
?

[JonathanHenson]

There's a full log setup example here. The line that sets the log level is here:
https://github.com/awslabs/aws-c-http/blob/master/bin/elasticurl/main.c#L457

[ravichandhraRean]

You probably just need the header files, these dependencies get exported automatically by the SDK.

Have you included:
#include <aws/io/logging.h>
?

This resolved the compilation error.

Now working on enabling log for TRACE level.

Thank you @JonathanHenson

[JonathanHenson]

I don't think you use MTLS when connecting to a green grass core device. Can you try just using the standard TLS options (DefaultClient) and then just set the CA?

[Kevin-Tacheny]

We are using Io::TlsContextOptions::InitClientWithMtls Is there a different method? From: Jonathan M. Henson <notifications@github.com> Sent: Wednesday, March 27, 2019 2:39 PM To: awslabs/aws-iot-device-sdk-cpp-v2 <aws-iot-device-sdk-cpp-v2@noreply.github.com> Cc: Kevin Tacheny <kevin.tacheny@hitachivantara.com>; Comment <comment@noreply.github.com> Subject: Re: [awslabs/aws-iot-device-sdk-cpp-v2] Greengrass support (#8) ***** EXTERNAL EMAIL ***** I don't think you use MTLS when connecting to a green grass core device. Can you try just using the standard TLS options (DefaultClient) and then just set the CA? — You are receiving this because you commented. Reply to this email directly, view it on GitHub<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fawslabs%2Faws-iot-device-sdk-cpp-v2%2Fissues%2F8%23issuecomment-477318075&data=01%7C01%7Ckevin.tacheny%40hitachivantara.com%7C492ad040bef44fb122a608d6b2ebdf6a%7C18791e1761594f52a8d4de814ca8284a%7C0&sdata=ZDju18VumE1AneMjM7BnHSC%2BDyZ5eVe%2BEjwyZbgoD84%3D&reserved=0>, or mute the thread<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAtkzmogNCxfpPty26nl-vbblUBOWSFhmks5va8jYgaJpZM4bj6Ls&data=01%7C01%7Ckevin.tacheny%40hitachivantara.com%7C492ad040bef44fb122a608d6b2ebdf6a%7C18791e1761594f52a8d4de814ca8284a%7C0&sdata=d9rTSFCspgQ3c2DYvA7sbZaOlFSOMuCU7s7F2VQBh%2Bc%3D&reserved=0>.