发布 MQTT、AWS IoT 时出现“SSL：CERTIFICATE_VERIFY_FAILED”错误

Question

我收到以下错误：

[ERROR] SSLError: SSL validation failed for https://data.iot.ap-northeast-2.amazonaws.com/topics/app%2Ftest%2Fresponse?qos=1 [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1124)
Traceback (most recent call last):
  File "/var/task/app.py", line 197, in lambda_handler
    mqttcli.test('test', '11111', {}, 1, 200)
  File "/opt/python/lib/python3.8/site-packages/connectors/MQTTClient.py", line 40, in test
    response = self._iot_client.publish(
  File "/var/task/botocore/client.py", line 357, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/var/task/botocore/client.py", line 662, in _make_api_call
    http, parsed_response = self._make_request(
  File "/var/task/botocore/client.py", line 682, in _make_request
    return self._endpoint.make_request(operation_model, request_dict)
  File "/var/task/botocore/endpoint.py", line 102, in make_request
    return self._send_request(request_dict, operation_model)
  File "/var/task/botocore/endpoint.py", line 136, in _send_request
    while self._needs_retry(attempts, operation_model, request_dict,
  File "/var/task/botocore/endpoint.py", line 253, in _needs_retry
    responses = self._event_emitter.emit(
  File "/var/task/botocore/hooks.py", line 356, in emit
    return self._emitter.emit(aliased_event_name, **kwargs)
  File "/var/task/botocore/hooks.py", line 228, in emit
    return self._emit(event_name, kwargs)
  File "/var/task/botocore/hooks.py", line 211, in _emit
    response = handler(**kwargs)
  File "/var/task/botocore/retryhandler.py", line 183, in __call__
    if self._checker(attempts, response, caught_exception):
  File "/var/task/botocore/retryhandler.py", line 250, in __call__
    should_retry = self._should_retry(attempt_number, response,
  File "/var/task/botocore/retryhandler.py", line 277, in _should_retry
    return self._checker(attempt_number, response, caught_exception)
  File "/var/task/botocore/retryhandler.py", line 316, in __call__
    checker_response = checker(attempt_number, response,
  File "/var/task/botocore/retryhandler.py", line 222, in __call__
    return self._check_caught_exception(
  File "/var/task/botocore/retryhandler.py", line 359, in _check_caught_exception
    raise caught_exception
  File "/var/task/botocore/endpoint.py", line 200, in _do_get_response
    http_response = self._send(request)
  File "/var/task/botocore/endpoint.py", line 269, in _send
    return self.http_session.send(request)
  File "/var/task/botocore/httpsession.py", line 281, in send
    raise SSLError(endpoint_url=request.url, error=e)

这是导致此错误的代码：

_iot_client = boto3.client('iot-data',
                                aws_access_key_id=AWS_ACCESS_KEY_ID,
                                aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
                                region_name= REGION_NAME)
    response = _iot_client.publish(
        topic = "app/test/response",
        qos = 1,
        payload = json.dumps(
            {
                'msgid': msgid,
                'status': status,
                'data': payload
            }
        )
    )

通过boto3在S3或其他服务中没有错误。只有物联网数据。

当我运行 .py 时它可以正常工作。

但部署到 lambda 后运行时出现错误。

直到最近才出现错误。

Answer 1

我们也遇到了这个问题，在我们的案例中，“certifi”库（请求依赖项）中的更新导致与 boto3 iot publish 发生冲突，回滚版本解决了问题，尽管我们不完全确定是什么确实失败了。

Answer 2

您需要获取“Data-ATS”端点，而不是内置的不受信任的“Symantec”端点。试试这个：

import boto3


def get_aws_iot_ats_endpoint():
    """
    Get the "Data-ATS" endpoint instead of the
    untrusted "Symantec" endpoint that's built-in.
    """
    iot_client = boto3.client(
        "iot",
        aws_access_key_id=AWS_ACCESS_KEY_ID,
        aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
        region_name= REGION_NAME,
        verify=True
    )
    details = iot_client.describe_endpoint(endpointType="iot:Data-ATS")
    host = details.get("endpointAddress")
    return f"https://{host}"


IOT_DATA_ENDPOINT = get_aws_iot_ats_endpoint()

client_iot = boto3.client(
    "iot-data",
    aws_access_key_id=AWS_ACCESS_KEY_ID,
    aws_secret_access_key=AWS_SECRET_ACCESS_KEY,
    region_name= REGION_NAME,
    verify=True,
    endpoint_url=IOT_DATA_ENDPOINT
)

response = client_iot.publish(
        topic = "app/test/response",
        qos = 1,
        payload = json.dumps(
            {
                'msgid': msgid,
                'status': status,
                'data': payload
            }
        )
    )

Answer 3

我有同样的错误。

只需在代码开头插入：`

from botocore.exceptions import ClientError

它应该可以工作。

最好的。