Azure 下游设备到带有 python 的 Edge 网关

Question

我正在尝试与 Azure 网关方案进行下游设备通信。 Raspberry Pi 是物联网设备，我使用 Jetson nano 作为边缘设备，我尝试了对称方法和自签名，两者似乎都失败了。请帮我解决一下这个。我从这个 azure tutorial https://docs.microsoft.com/en-us/azure/iot-edge/how-to-authenticate-downstream-deviceand 尝试过，我从这里尝试了 send_message.py 和 send_message_x509.py：https://github.com/Azure/azure-iot-sdk-python/tree/master/azure-iot-device/samples/async-hub-scenariosAnd 我使用 azure-iot-test-only.root.ca.cert.pem (ROOTCA)，iot-edge-device -downedge-full-chain.cert.pem（设备证书）和 iot-edge-device-downedge.key.pem（设备密钥）作为 .py 脚本中的凭据...和主机名作为边缘网关主机名。 .但它是失败的。此命令工作正常并返回 OK 状态：

“openssl s_client -connect mygateway.contoso.com:8883 -CAfile /certs/azure-iot-test-only.root.ca.cert.pem -showcerts”

但 .py 仍然返回 TLS 身份验证错误，如下所示

TLS handshake failed., System.AggregateException: One or more errors occurred. (Authentication failed, see inner exception.) ---> System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception. ---> Interop+OpenSsl+SslException: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL. ---> Interop+Crypto+OpenSslCryptographicException: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
   --- End of inner exception stack trace ---
   at Interop.OpenSsl.DoSslHandshake(SafeSslHandle context, Byte[] recvBuf, Int32 recvOffset, Int32 recvCount, Byte[]& sendBuf, Int32& sendCount)
   at System.Net.Security.SslStreamPal.HandshakeInternal(SafeFreeCredentials credential, SafeDeleteContext& context, ArraySegment`1 inputBuffer, Byte[]& outputBuffer, SslAuthenticationOptions sslAuthenticationOptions)
   --- End of inner exception stack trace ---
   at System.Net.Security.SslStream.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception)
   at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.PartialFrameCallback(AsyncProtocolRequest asyncRequest)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Security.SslStream.EndProcessAuthentication(IAsyncResult result)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
   --- End of inner exception stack trace ---
---> (Inner Exception #0) System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception. ---> Interop+OpenSsl+SslException: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL. ---> Interop+Crypto+OpenSslCryptographicException: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
   --- End of inner exception stack trace ---

请让我知道如何解决此错误，或任何替代代码来实现相同。

Answer 1

您是否修改了 send_message.py 以在边缘设备中添加受信任的根 ca 证书 (azure-iot-test-only.root.ca.cert.pem) 作为受信任的证书？要在叶子设备中使用该 python SDK，您必须使用 create_from_connection_string 函数的重载，该函数允许您传入边缘设备的根 ca 证书（以便 SDK“信任”它）。

例如，我将 send_message.py 的前几行修改为此，它可以工作（在将根 ca 证书复制到我的叶子设备之后）

async def main():
    # Fetch the connection string from an enviornment variable
    conn_str ="<your connection string, including GatewayHostName>"

    #change this path to YOUR cert -- just left mine in as an example...
    certfile = open("/home/stevebus/edge/certs/azure-iot-test-only.root.ca.cert.pem")
    root_ca_cert = certfile.read()

    # Create instance of the device client using the connection string

device_client= IoTHubDeviceClient.create_from_connection_string(connection_string=conn_str,server_verification_cert=root_ca_cert)

这对我有用...