Forums - QCA4020 cert download error for AWS

9 posts / 0 new
Last post
QCA4020 cert download error for AWS
akshay.b
Join Date: 2 Aug 19
Posts: 62
Posted: Wed, 2019-11-13 12:17

Hello,

Working on QCLI_demo projct and referring developer guide document page no. 221 topic 6.3.17.7.3 Download the certificates and write to file system.

I am getting error when i send the cert get command with approprieate file located at certs folder and correct IP address of host containing the cert files.

We are performing below steps:

1. Connecting the qca4020 to wifi accesspoint as given in 6.3.17.7.2 Connection procedure.

2. Following the steps commands given in 6.3.7 Certificate management demo and starting certification server ./certcs -s.

3. entring command
Net> cert get foo.cert.bin IPADDR (and other arguments as given in 6.3.7 Certificate management demo)
(the file name are same that we are generating and the IPADDRESS is the IP of host where we started certification server)

 
After executing this command we are getting error message on terminal
ERROR: Failed to connect to qapi_connect, error -1.
 

It looks like the qca4020 is not able to connect to the passed IP, all firewall are disabled on the host where we started certification server.

What can be the issue?

Thank you,

Akshaay

 

  • Up0
  • Down0
c_rpedad
Profile picture
Join Date: 18 Jun 18
Location: San Jose
Posts: 317
Posted: Wed, 2019-11-13 13:48

qapi_connect() retruns -1 incase the server address is not valid or client is not able to connect to server.

Can you try to ping the server IP before download of certificate , also provide us the console serial log to verify your instructions:

> wlan enable
> wlan setdevice 1
> wlan connect Demo_AP
> net dhcpv4c wlan1
>net ping 10.177.215.145
> net cert get root_ca.bin 10.177.215.145 -s ca.bin -t ca_list

Net: Successfully downloaded root_ca.bin
Net: Successfully stored CA list
Net: ca.bin is stored in NV memory
  • Up0
  • Down0
akshay.b
Join Date: 2 Aug 19
Posts: 62
Posted: Thu, 2019-11-14 06:05

Hello,

Thank you, i was able to get rid of the error qapi_connect() retruns -1  now i am stuck in ecosystem part and the error i am facing is 

Ecosystem: Shadow Register Delta Error

Below are the logs for ecosystem part when trying to execuite shadow example:

Ecosystem> aws_set_schema a24plr9t73a2wh-ats.iot.us-west-2.amazonaws.com MyIoTButton /spinor/json.txt QZD.pem 100
 
Ecosystem> aws_set_params test 3 123 1111 0000
 
Ecosystem> aws_set_params test1 3 456 1111 0000
 
Ecosystem> aws_run
 
Ecosystem>
 
Ecosystem: AWS IoT SDK Version 3.0.1-
Ecosystem: Shadow Init
 
Ecosystem: Shadow Connect
 
Ecosystem: Shadow Connection successful
 
Ecosystem: Shadow Register Delta Error
Ecosystem: =======================================================================================
Ecosystem: Update Shadow: {"state":{"reported":{"test":123,"test1":456}}, "clientToken":"Hardik-0"}
 
Ecosystem: *****************************************************************************************
Ecosystem: Randomizing Data
Ecosystem: An error occurred in the loop -12Disconnectingc
 
 
Do i need to make changes in the aws console shadow document section and edit the shadow state with some jsone code, please suggest what i need to write.
 
Thank you,
 
Akshaay

 

  • Up0
  • Down0
c_rpedad
Profile picture
Join Date: 18 Jun 18
Location: San Jose
Posts: 317
Posted: Thu, 2019-11-14 10:52

Error -12 corresponds to  NETWORK_SSL_READ_ERROR . Kindly refer to include/aws_iot_error.h inside thirdparty aws folder for more information on error codes.

Can you provide us the list of console commands perfomed during the test case ?

Kindly try to delete the json.txt file using command "fs rm /spinor/json.txt" and perform below commands:

>> Connect QCA4020 to AP and acquire IP address:
>> net sntpc start
>> net sntpc
 addsrv pool.ntp.org
>> net dnsc 
start
>> 
fs write /spinor/json.txt 0  "7b0d0a202020202274657374223a202274657374222c0d0a20202020227465737431223a20227465737431220d0a7d00"
>> fs ls
>> ecosystem 
>>
aws_set_schema a24plr9t73a2wh-ats.iot.us-west-2.amazonaws.com MyIoTButton /spinor/json.txt QZD.pem 100
>> 
aws_set_params test 1 3 111111 000000
>> 
aws_set_params test1 2 0 111111 000000
>> 
aws_run

Kindly let us know if these instructions worked.

 
 
 


 

  • Up0
  • Down0
akshay.b
Join Date: 2 Aug 19
Posts: 62
Posted: Fri, 2019-11-15 05:52

Hi,

1) I tried the solution suggested by you but was not able to solve the error Error -12 corresponds to  NETWORK_SSL_READ_ERROR. 

2) As it is error related to SSL i found 

Quote:
see point 3 in the Certificate management demo section
in developer guide document.

  • 3) Point 3 in certificate management demo section lists following commands
           Net> ssl start client
           Net: SSL client started
     
          Net> ssl cert client calist aws_ca_list.bin
          Net: aws_ca_list.bin loaded from secure storage repository
     
          Net> ssl cert client certificate QZD.pem
          Net: QZD.pem loaded from secure storage repository
  •  
  •       Net> ssl config clint protocol TLS1.2 time 1
          Net: SSL clint configuration changed
  • I entered these commands after downloading root CA, are these commands necessery as they are related to SSH?
  •  
  • 4) Below are the logs:

After connecting to AP and acquiring IP address

Net> sntpc start

Net> sntpc addsrv pool.ntp.org
 
Net> dnsc start
 
Net> cert get certificate.pem.crt 192.168.12.110 -k private.pem.key -s QZD.pem -t pem_cert
Net: Successfully downloaded certificate.pem.crt
Net: Successfully downloaded private.pem.key
Net: Successfully converted and stored certificate
Net: QZD.pem is stored in NV memory
 
Net> cert get root_ca.pem 192.168.12.110 -s aws_ca_list.bin -t pem_ca_list
Net: Successfully downloaded root_ca.pem
Net: Successfully converted and stored CA list
Net: aws_ca_list.bin is stored in NV memory
 
Fs> write /spinor/json.txt 0  "7b0d0a202020202274657374223a202274657374222c0d0a20202020227465737431223a20227465737431220d0a7d00"
 
Fs> ls
 
Fs:        128 /spinor/etc/passwd
Fs:       1824 /spinor/ssl/certs/QZD.pem
Fs:        512 /spinor/ssl/ca_lists/aws_ca_list.bin
Fs:         48 /spinor/json.txt
 
Ecosystem> aws_set_schema a24plxxxxxa2wh-ats.iot.us-west-2.amazonaws.com MyIoTButton /spinor/json.txt QZD.pem 100
 
Ecosystem> aws_set_params test 1 3 111111 000000
 
Ecosystem> aws_set_params test1 2 0 111111 000000
 
Ecosystem> aws_run
 
Ecosystem>
 
Ecosystem: AWS IoT SDK Version 3.0.1-
Ecosystem: Shadow Init
 
Ecosystem: Shadow Connect
 
Ecosystem: Shadow Connection successful
 
Ecosystem: Shadow Register Delta Error
Ecosystem: =======================================================================================
Ecosystem: Update Shadow: {"state":{"reported":{"test":3,"test1":0}}, "clientToken":"Hardik-0"}
 
Ecosystem: *****************************************************************************************
Ecosystem: Randomizing Data
Ecosystem: An error occurred in the loop -12Disconnecting
 

Thank you,

 

Akshaay.

  • Up0
  • Down0
c_rpedad
Profile picture
Join Date: 18 Jun 18
Location: San Jose
Posts: 317
Posted: Fri, 2019-11-15 09:49

You dont need to execute the SSL related commands.

If its an issue with SSL connection, you should observe "Shadow Connection Error", in your case, shadow connection is successfull.

Can you confirm if the Thing Policy Document in AWS console is as below :
You can Edit Policy Information as below : 
Login to aws amazon console:  IoT Core -> Manage -> Things -> MyIoTButton -> Security -> Click on Certificate -> Policy -> Click on Policy -> Edit policy document.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

 

 

 

  • Up0
  • Down0
akshay.b
Join Date: 2 Aug 19
Posts: 62
Posted: Fri, 2019-11-15 11:41

Currently my policy document contain following code

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "*"
    }
  ]
}

 

  • Up0
  • Down0
c_rpedad
Profile picture
Join Date: 18 Jun 18
Location: San Jose
Posts: 317
Posted: Fri, 2019-11-15 12:05

Kindly edit your policy document to allow publish/subscribe and receive along with connect:
 
You can Edit document as  set Action to "iot:*" to allow all.

  • Up0
  • Down0
akshay.b
Join Date: 2 Aug 19
Posts: 62
Posted: Fri, 2019-11-15 12:30

Thank you for your suggestion, i will try it and discuss with you further.

Till then can you please reply to the query for my post in below link as i am stuck at that issue from long time

https://developer.qualcomm.com/forum/qdn-forums/hardware/qca4020-qca4024/67244

Appreciate your help.

  • Up0
  • Down0
or Register

Opinions expressed in the content posted here are the personal opinions of the original authors, and do not necessarily reflect those of Qualcomm Incorporated or its subsidiaries (“Qualcomm”). The content is provided for informational purposes only and is not meant to be an endorsement or representation by Qualcomm or any other party. This site may also provide links or references to non-Qualcomm sites and resources. Qualcomm makes no representations, warranties, or other commitments whatsoever about any non-Qualcomm sites or third-party resources that may be referenced, accessible from, or linked to this site.