Can NOT sent a certificate chain which contains two certificate

[gmlan]

Confirm by changing [ ] to [x] below to ensure that it's a bug:

• [ x] I've searched for previous similar issues and didn't find any solution

Known Issue

• [x ] I'm using ATS data type endpoint: the endpoint should look like <prefix>-ats.iot.<region>.amazonaws.com

Describe the bug
As following code, mqttConnectionCertPem contains two PEM, one for device and one for CA. This is to implement JITP (https://aws.amazon.com/blogs/iot/setting-up-just-in-time-provisioning-with-aws-iot-core/) where cat deviceCert.crt rootCA.pem > deviceCertAndCACert.crt

AwsIotMqttConnectionBuilder.newMtlsBuilder(mqttConnectionCertPem, mqttConnectionKeyPem)

The error I got is "PEM has greater than expected depth, Expected Max: 1, Acutal: 2"

SDK version number
1.0.x

Platform/OS/Hardware/Device
macOS

To Reproduce (observed behavior)

1. Get a CA, and use it to sign a device Cert
2. Put the two Certs PEM into one
3. call AwsIotMqttConnectionBuilder.newMtlsBuilder

Expected behavior
MQTT should connected

Logs/output
If applicable, add logs or error output.

To enable logging, set the following system properties:

REMEMBER TO SANITIZE YOUR PERSONAL INFO

-Daws.crt.debugnative=true
-Daws.crt.log.destination=File
-Daws.crt.log.level=Trace
-Daws.crt.log.filename=<path and filename>

Additional context
Add any other context about the problem here.

[jmklix]

It looks like you are running into this error, which isn't expecting the concatenated certs. I can't seem to reproduce the exact same error that you are getting, but I can get the same error as mentioned here.

Are you generating your certs the same as in the guide you linked? and are you using the pubsub to test this?

[gmlan]

1. I got concatenated certs as mqttConnectionCertPem according here
   cat deviceCert.crt rootCA.pem > deviceCertAndCACert.crt

2. I call AwsIotMqttConnectionBuilder.newMtlsBuilder(mqttConnectionCertPem, mqttConnectionKeyPem)

3. I got PEM has greater than expected depth, Expected Max: 1, Acutal: 2 as you.

[jmklix]

If everything is done correctly you shouldn't need to concatenate the deviceCert.crt and rootCA.pem. This step:
aws iot register-ca-certificate --ca-certificate file://rootCA.pem --verification-cert file://verificationCert.pem --set-as-active --allow-auto-registration --registration-config file://provisioning-template.json

registers your cert so when you call AwsIotMqttConnectionBuilder.newMtlsBuilder(mqttConnectionCertPem, mqttConnectionKeyPem) just pass deviceCert.crt as the first parameter.

[gmlan]

No, that wont work.

1. If customer call register-ca-certificate twice to register two CAs, then pass deviceCert.crt as the first parameter? Which CA will be used on IoT backend?

2. Current IoT backend logic is:
   a. get passed concatenate cert: deviceCert & CA
   b. Check whether CA is registered, if fail, reject connection.
   c. If pass, check passed deviceCert is signed by passed CA
   d. If pass, add deviceCert to DB and do other provisioning thing.

Also this blog use Mosquitto pass concatenated PEM, this is the correct way.

$ cat deviceCert.crt rootCA.pem > deviceCertAndCACert.crt
$ mosquitto_pub --cafile root.cert --cert deviceCertAndCACert.crt --key deviceCert.key -h <prefix>.iot.us-east-1.amazonaws.com -p 8883 -q 1 -t foo/bar -I anyclientID --tls-version tlsv1.2 -m "Hello" -d

[jmklix]

This should be fixed now. Please let us know if you run into any more problems with certificate chains

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[tonisives]

@jmklix In which release is it fixed? I tried https://github.com/aws/aws-iot-device-sdk-java-v2/releases/tag/v1.8.0 (software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk:1.8.0), but it still returns the error

PEM has greater than expected depth, Expected Max: 1, Acutal: 2

This is just like the OP described in the Describe the bug section.

[jmklix]

@tonisives the fix was in one of the dependencies: aws-c-io.
Here is an updated guide for how create certs for JITP. It currently works with this sdk, but please open a new issue if you are still having any problems while using this sdk