python - 使用 python 将 Azure 下游设备连接到 Edge 网关

Question

我正在尝试让下游设备与 Azure 网关场景进行通信。 Raspberry Pi 是 IoT 设备，我使用 Jetson nano 作为边缘设备，我尝试了对称方法和自签名，两者似乎都失败了。请在这件事上给予我帮助。我尝试从这个 azure 教程https://learn.microsoft.com/en-us/azure/iot-edge/how-to-authenticate-downstream-deviceand我从这里尝试了 send_message.py 和 send_message_x509.py:https://github.com/Azure/azure-iot-sdk-python/tree/master/azure-iot-device/samples/async-hub-scenariosAnd我使用 azure-iot-test-only.root.ca.cert.pem (ROOTCA)、iot-edge-device-downedge-full-chain.cert.pem (设备证书) 和 iot-edge-device-downedge。 key.pem(设备 key )作为 .py 脚本内的凭据...主机名作为边缘网关主机名..但这是失败的。此命令工作正常并返回 OK 状态:

“openssl s_client -connect mygateway.contoso.com:8883 -CAfile/certs/azure-iot-test-only.root.ca.cert.pem -showcerts”

但 .py 仍然返回并出现 TLS 身份验证错误，如下

TLS handshake failed., System.AggregateException: One or more errors occurred. (Authentication failed, see inner exception.) ---> System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception. ---> Interop+OpenSsl+SslException: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL. ---> Interop+Crypto+OpenSslCryptographicException: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
   --- End of inner exception stack trace ---
   at Interop.OpenSsl.DoSslHandshake(SafeSslHandle context, Byte[] recvBuf, Int32 recvOffset, Int32 recvCount, Byte[]& sendBuf, Int32& sendCount)
   at System.Net.Security.SslStreamPal.HandshakeInternal(SafeFreeCredentials credential, SafeDeleteContext& context, ArraySegment`1 inputBuffer, Byte[]& outputBuffer, SslAuthenticationOptions sslAuthenticationOptions)
   --- End of inner exception stack trace ---
   at System.Net.Security.SslStream.StartSendAuthResetSignal(ProtocolToken message, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfo exception)
   at System.Net.Security.SslStream.CheckCompletionBeforeNextReceive(ProtocolToken message, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.StartSendBlob(Byte[] incoming, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.ProcessReceivedBlob(Byte[] buffer, Int32 count, AsyncProtocolRequest asyncRequest)
   at System.Net.Security.SslStream.PartialFrameCallback(AsyncProtocolRequest asyncRequest)
--- End of stack trace from previous location where exception was thrown ---
   at System.Net.Security.SslStream.EndProcessAuthentication(IAsyncResult result)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
   --- End of inner exception stack trace ---
---> (Inner Exception #0) System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception. ---> Interop+OpenSsl+SslException: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL. ---> Interop+Crypto+OpenSslCryptographicException: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
   --- End of inner exception stack trace ---

请告诉我如何解决此错误，或任何替代代码来实现相同的目的。

Answer 1

您是否修改了 send_message.py 以添加边缘设备受信任的根 ca 证书 (azure-iot-test-only.root.ca.cert.pem) 作为受信任的证书？要在叶子设备中使用该 python SDK，您必须使用 create_from_connection_string 函数的重载，该函数允许您传入边缘设备根 ca 证书(以便 SDK “信任”它)。

例如，我将 send_message.py 的前几行修改为此并且它可以工作(将根 ca 证书复制到我的叶设备后)

async def main():
    # Fetch the connection string from an enviornment variable
    conn_str ="<your connection string, including GatewayHostName>"

    #change this path to YOUR cert -- just left mine in as an example...
    certfile = open("/home/stevebus/edge/certs/azure-iot-test-only.root.ca.cert.pem")
    root_ca_cert = certfile.read()

    # Create instance of the device client using the connection string

device_client= IoTHubDeviceClient.create_from_connection_string(connection_string=conn_str,server_verification_cert=root_ca_cert)

这对我有用......