# AWS IoT - TLS Client Certificate Authentication using Zymkey 4i **URL:** \ **Category:** ZYMKEY4\ **Tags:** aws-iot\ **Created:** [March 15, 2021, 7:00am UTC](https://community.zymbit.com/t/aws-iot-tls-client-certificate-authentication-using-zymkey-4i/214 "2021-03-15T07:00:00Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Connor\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/c/e274bd/32.png) [@Connor\_of\_Zymbit](https://community.zymbit.com/u/Connor_of_Zymbit)\ **Post date:** [March 15, 2021, 7:00am UTC](https://community.zymbit.com/t/aws-iot-tls-client-certificate-authentication-using-zymkey-4i/214/1 "2021-03-15T07:00:00Z")
See [Zymbit’s Documentation Site](https://docs.zymbit.com/tutorials/aws-iot/) for the most recent AWS documentation. ---
**Author:** ![jzheng](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jzheng](https://community.zymbit.com/u/jzheng)\ **Post date:** [August 28, 2017, 2:55am UTC](https://community.zymbit.com/t/aws-iot-tls-client-certificate-authentication-using-zymkey-4i/214/2 "2017-08-28T02:55:25Z")
Unlisted on August 28, 2017, 2:55am UTC ---
**Author:** ![Phil\_S\_Zymbit\_1](https://avatars.discourse-cdn.com/v4/letter/p/45deac/32.png) [@Phil\_S\_Zymbit\_1](https://community.zymbit.com/u/Phil_S_Zymbit_1)\ **Post date:** [August 28, 2017, 4:22pm UTC](https://community.zymbit.com/t/aws-iot-tls-client-certificate-authentication-using-zymkey-4i/214/3 "2017-08-28T16:22:27Z")
Listed on August 28, 2017, 4:22pm UTC ---
**Author:** ![agilesai](https://avatars.discourse-cdn.com/v4/letter/a/ac8455/32.png) [@agilesai](https://community.zymbit.com/u/agilesai)\ **Post date:** [March 15, 2021, 9:31pm UTC](https://community.zymbit.com/t/aws-iot-tls-client-certificate-authentication-using-zymkey-4i/214/4 "2021-03-15T21:31:57Z")
Are you using Zymkey private key to create Device certificate? what is nonzym.key file in the above steps? #replace endpoint and region with the appropriate values curl --tlsv1.2 --cacert CA\_files/zk\_ca.pem --cert zymkey.crt --key nonzymkey.key --engine zymkey\_ssl --key-type ENG -v -X POST -d “{ “hello”: “world”}” “[https://endpoint.iot.region.amazonaws.com:8443/topics/hello/world](https://endpoint.iot.region.amazonaws.com:8443/topics/hello/world)” what key should we send in the above statement? Since i dont have access to private key? ---
**Author:** ![Bob\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/b/82dd89/32.png) [@Bob\_of\_Zymbit](https://community.zymbit.com/u/Bob_of_Zymbit)\ **Post date:** [March 15, 2021, 9:31pm UTC](https://community.zymbit.com/t/aws-iot-tls-client-certificate-authentication-using-zymkey-4i/214/5 "2021-03-15T21:31:57Z")
Zymkey is used to generate a certificate signing request to a CA. The CA will then generate a certificate using Zymkey’s public key. In normal operation (e.g. via the curl command), zymkey is used for the client signature part of the TLS handshake which references the client the certificate. The reason that there is an entry for the key in the curl command is because older versions of curl (and this may still be true today) needed to have a key file even though we are referencing a private key through an openssl hardware engine. Try one of the following things: 1. Create an empty key with `touch nonzymkey.key`, then run the curl command 2. If that doesn’t work, try `openssl ecparam -name prime256v1 -out nonzymkey.key`, then run the curl command. ---
**Author:** ![agilesai](https://avatars.discourse-cdn.com/v4/letter/a/ac8455/32.png) [@agilesai](https://community.zymbit.com/u/agilesai)\ **Post date:** [March 15, 2021, 9:31pm UTC](https://community.zymbit.com/t/aws-iot-tls-client-certificate-authentication-using-zymkey-4i/214/6 "2021-03-15T21:31:57Z")
Hi, I want to edit zymkey\_ssl file to meet the requirements. Where can i find that file? Is that file publicly available? ---
**Author:** ![pedz88](https://avatars.discourse-cdn.com/v4/letter/p/a3d4f5/32.png) [@pedz88](https://community.zymbit.com/u/pedz88)\ **Post date:** [March 15, 2021, 9:31pm UTC](https://community.zymbit.com/t/aws-iot-tls-client-certificate-authentication-using-zymkey-4i/214/7 "2021-03-15T21:31:57Z")
Hi, did you ever write the future post showing how to communicate with AWS IoT through their rest API and authenticating with Zymkey’s private key in Python? I am trying to learn how to create an SSL context in python that uses the private key on the Zymkey HSM rather than point to a file on the storage for a private key. ---
**Author:** ![Michelle\_of\_Zymbit](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michelle\_of\_Zymbit](https://community.zymbit.com/u/Michelle_of_Zymbit)\ **Post date:** [August 25, 2021, 4:56pm UTC](https://community.zymbit.com/t/aws-iot-tls-client-certificate-authentication-using-zymkey-4i/214/8 "2021-08-25T16:56:00Z")
Closed on August 25, 2021, 4:56pm UTC