Forums - aws iot connect error -19

7 posts / 0 new
or Register
Last post
aws iot connect error -19
su.xiu.ge
Join Date: 29 Dec 15
Posts: 4
Posted: Sun, 2018-11-18 19:01
Top

Hello,

I test aws iot device sdk version 2.1.1 on QCA4020.OR.2.0_00048 SDK  QCLI_DEMO . reference document is "80-ya121-140_b_qca402xcdb2x_development_kit_user_guide.pdf", follow the steps of 6.3.16.5. but when run command "aws_run", the connection error is -19.

I also test aws iot device sdk version 2.1.1 shadown exmaple on another laptop(linux). the shadown exmaple can run succesffully, it can connect with Cloud  and update the values. 

I have used same thing name , hostname , cert etc. information on above testing case.

what should I check further to find out the reason of error -19?

my aws iot manange police is 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "arn:aws:iot:us-east-1:xxx:topic/test"
    }
  ]
}

Thanks,

Xiuge

 

  • Up0
  • Down0
Re: aws iot connect error -19
c_rpedad
Profile picture
Join Date: 18 Jun 18
Location: San Jose
Posts: 317
Posted: Mon, 2018-11-19 10:04
Top

Error - 19 is returned when root certificate is invalid.
However based on your analysis , AWS connection is working fine with Linux Box, Can you try to set the aws params again and execute aws_run command ?

Kindly provide us the console logs and we assume the issue might be sporadic and kindly try multple cycles of setting params, json key values and aws_run to confirm the issue.

  • Up0
  • Down0
Re: aws iot connect error -19
su.xiu.ge
Join Date: 29 Dec 15
Posts: 4
Posted: Tue, 2018-11-20 00:27
Top

Hi Raja,

 

You are right, it's the root CA issue.

I downloaded the root CA when I created thing,

The instruction(on amazon when create thing) is :

You also need to download a root CA for AWS IoT:
A root CA for AWS IoTDownload

 

the link is here : https://docs.aws.amazon.com/iot/latest/developerguide/managing-device-ce...

I downloaded the first CA 1   "RSA 2048 bit key: Amazon Root CA 1" and used it to test, aws connetion then got error when run aws_run. However, the original aws iot device SDK on linux can work with this root CA 1, that's the reason I didn't suspect root CA  at first. Could you help explain the reason?

 

by the way, I have got another root CA from others , and QCA4020 aws connection is successful.

 

thanks,

Xiuge

 

 

  • Up0
  • Down0
Re: aws iot connect error -19
c_rpedad
Profile picture
Join Date: 18 Jun 18
Location: San Jose
Posts: 317
Posted: Tue, 2018-11-27 16:10
Top

Can you try with the legacy rootCA and confim the issue is still seen ?

RSA 2048 bit key: VeriSign Class 3 Public Primary G5 root CA certificate https://www.symantec.com/content/en/us/enterprise/verisign/roots/VeriSig...

  • Up0
  • Down0
Re: aws iot connect error -19
su.xiu.ge
Join Date: 29 Dec 15
Posts: 4
Posted: Thu, 2018-12-20 01:28
Top

Thanks, the issue has been solved with correct root CA.

  • Up0
  • Down0
Re: aws iot connect error -19
ben.olivier
Join Date: 23 Jul 19
Posts: 4
Posted: Fri, 2019-09-13 03:43
Top

Hello,

I am getting the same error (-19) with my root CA. I tried using the one linked here but it didn't solve the issue for me.

One thing I'm not sure to understand is the 'single line statement' format expected?

Another question would be the line return format (windows, linux, none?). I tried several but not sure what is the one expected.

Please find below how I currently declare it:

static const uint8_t aws_root_ca[] =
        "-----BEGIN CERTIFICATE-----\n"
        "MIIE0zCCA7ugAwIBAgIQGNrRniZ96LtKIVjNzGs7SjANBgkqhkiG9w0BAQUFADCB\n"
        "yjELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQL\n"
        "ExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJp\n"
        "U2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxW\n"
        "ZXJpU2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0\n"
        "aG9yaXR5IC0gRzUwHhcNMDYxMTA4MDAwMDAwWhcNMzYwNzE2MjM1OTU5WjCByjEL\n"
        "MAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZW\n"
        "ZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTowOAYDVQQLEzEoYykgMjAwNiBWZXJpU2ln\n"
        "biwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5MUUwQwYDVQQDEzxWZXJp\n"
        "U2lnbiBDbGFzcyAzIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9y\n"
        "aXR5IC0gRzUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCvJAgIKXo1\n"
        "nmAMqudLO07cfLw8RRy7K+D+KQL5VwijZIUVJ/XxrcgxiV0i6CqqpkKzj/i5Vbex\n"
        "t0uz/o9+B1fs70PbZmIVYc9gDaTY3vjgw2IIPVQT60nKWVSFJuUrjxuf6/WhkcIz\n"
        "SdhDY2pSS9KP6HBRTdGJaXvHcPaz3BJ023tdS1bTlr8Vd6Gw9KIl8q8ckmcY5fQG\n"
        "BO+QueQA5N06tRn/Arr0PO7gi+s3i+z016zy9vA9r911kTMZHRxAy3QkGSGT2RT+\n"
        "rCpSx4/VBEnkjWNHiDxpg8v+R70rfk/Fla4OndTRQ8Bnc+MUCH7lP59zuDMKz10/\n"
        "NIeWiu5T6CUVAgMBAAGjgbIwga8wDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E\n"
        "BAMCAQYwbQYIKwYBBQUHAQwEYTBfoV2gWzBZMFcwVRYJaW1hZ2UvZ2lmMCEwHzAH\n"
        "BgUrDgMCGgQUj+XTGoasjY5rw8+AatRIGCx7GS4wJRYjaHR0cDovL2xvZ28udmVy\n"
        "aXNpZ24uY29tL3ZzbG9nby5naWYwHQYDVR0OBBYEFH/TZafC3ey78DAJ80M5+gKv\n"
        "MzEzMA0GCSqGSIb3DQEBBQUAA4IBAQCTJEowX2LP2BqYLz3q3JktvXf2pXkiOOzE\n"
        "p6B4Eq1iDkVwZMXnl2YtmAl+X6/WzChl8gGqCBpH3vn5fJJaCGkgDdk+bW48DW7Y\n"
        "5gaRQBi5+MHt39tBquCWIMnNZBU4gcmU7qKEKQsTb47bDN0lAtukixlE0kF6BWlK\n"
        "WE9gyn6CagsCqiUXObXbf+eEZSqVir2G3l6BFoMtEMze/aiCKm0oHw0LxOXnGiYZ\n"
        "4fQRbxC1lfznQgUy286dUV4otp6F01vvpX1FQHKOtw5rDgb7MzVIcbidJ4vEZV8N\n"
        "hnacRHr2lVz2XTIIM6RUthg/aFzyQkqFOFSDX9HoLPKsEdao7WNq\n"
        "-----END CERTIFICATE-----\n";
I also tried with other line ending format, as well as all the string on a single line (why would it matter?).
 
Thanks for your help,
Best regards,
Ben
 
 
  • Up0
  • Down0
Re: aws iot connect error -19
ben.olivier
Join Date: 23 Jul 19
Posts: 4
Posted: Fri, 2019-09-13 06:30
Top

Hello,

I've finally been able to make it work, using another CA from Amazon: 

- ECC 256 bit key: Amazon Root CA 3.

It's available on this page: https://docs.aws.amazon.com/iot/latest/developerguide/managing-device-certs.html

Would you know why it didn't work with the first two certificates used? They are the following, from the same page:

- RSA 2048 bit key: VeriSign Class 3 Public Primary G5 root CA certificate

- RSA 2048 bit key: Amazon Root CA 1.

Obviously one of the differences seems to be the key format,  ECC 256 bit vs RSA 2048 bit. Is it something in the configuration when storing the certificate that needs to be done differently?

Thanks for your help,

Best regards,

Ben

  • Up0
  • Down0
or Register

Opinions expressed in the content posted here are the personal opinions of the original authors, and do not necessarily reflect those of Qualcomm Incorporated or its subsidiaries (“Qualcomm”). The content is provided for informational purposes only and is not meant to be an endorsement or representation by Qualcomm or any other party. This site may also provide links or references to non-Qualcomm sites and resources. Qualcomm makes no representations, warranties, or other commitments whatsoever about any non-Qualcomm sites or third-party resources that may be referenced, accessible from, or linked to this site.