Hi Team, We are using Zymbit SEN for our project. I noticed that zymbit supports PKCS11, and the AWS IoT device client also supports secure elements. I attempted to use the AWS IoT device client to log in with zymbit’s private key. I referred to this tutorial: AWS IoT Device Client Secure Element …

Hi All, Thank you for your help. Problem resolved. Here what I have done to make it working: follow the tutorial AWS IoT - TLS Client Certificate Authentication | to sign a certificate With sudo, import the zymkey into pkcs#11 PKCS#11 Support Delete the code block from line 430 ~ 440, aws-iot-de…

By executing the aws-iot-device-client with root permission, we are able to load the private key from PKCS11 slot. However, we are facing a new error: Error log found in aws-iot-device-client.log 2024-07-02T08:34:13.520Z [ERROR] {SharedCrtResourceManager.cpp}: MQTT Connection failed with error: a…

I don’t know the aws-iot-device-client, but I got the “AWS_IO_TLS_ERROR_NEGOTIATION_FAILURE: TLS (SSL) negotiation failed” error with the awsiotsdk because I was using the wrong root CA. Could this be your problem also?

That’s possible, let me check.

I’m also leaning towards @grfo ’s answer as it appears that the certificate chain is not able to be verified, causing the error you are seeing. [image] chill: [DEBUG] [2024-07-02T08:34:13Z] [0000007f9abf0d40] [tls-handler] - ctx: Setting ALPN list x-amzn-mqtt-ca Would indicate that you are us…

Hi grfo, Does it work with AWS SDK? I have tested with curl command, it could be AmazonRootCA1.pem or AmazonRootCA3.pem curl --tlsv1.3 --cacert AmazonRootCA1.pem --cert 0d67571ca4bacc221802c0cd58c3215c349f7dd07dd3b66edc0c24c4f4de5b72-certificate.pem.crt --key 0d67571ca4bacc221802c0cd58c3215c349f7d…

Hi davidgs, I’m not sure it’s related to the Amazon root ca. With same configuration (AmazonRootCA1.pem), it works when I use the key and cert generated by AWS. Do you have an example implemented with pkcs11 and aws iot sdk or aws iot device client?

Hi chill, With the AmazonRootCA1.pem I don’t get the TLS error, however I still don’t get a successful connect. The error now is “sign resizing because digest and key lengths (32/64) do not match”. I have no idea what is wrong.

Sorry to have to drop this in the middle, but I am going to be away from the office/internet for the next 2 weeks. I’ll get someone else to step in as needed. dg

Glad to see you were able to resolve this! And thank you so much for coming back to post the solution! It will help others in the future I am sure! Best Regards, dg

Aws-iot-device-client Integration

ZYMKEY4

davidgs July 2, 2024, 1:03pm 5

I’m also leaning towards @grfo’s answer as it appears that the certificate chain is not able to be verified, causing the error you are seeing.

Would indicate that you are using an Amazon root ca.

Topic		Replies	Views
PKCS#11 Support ZYMKEY4	20	2158	June 6, 2025
Problem with testing TLS connection ZYMKEY4 aws-iot	3	654	January 3, 2022
AWS IoT MQTT connection and message upload with private key ZYMKEY4 aws-iot	0	446	July 21, 2021
AWS IoT Integrations ZYMKEY4 aws-iot	1	3135	August 25, 2021
AWS IoT - TLS Client Certificate Authentication using Zymkey 4i ZYMKEY4 aws-iot	7	7112	August 25, 2021

Aws-iot-device-client Integration

Related topics