Which AmazonRootCA1 to use with greengrass ?

Question

I have greengrass running in a docker container and have a few clients things setup running outside of the container.  I can pub/sub to the moquett mqtt only if I turn off using tls. Otherwise I get the root ca is untrusted error in greengrass.logs. I am using the one downloaded when the (client) thing certs are generated by aws for my client things. The greengrass installation has its own ca that was downloaded as part of the installation of the gg core device.  Do I need to copy that one from the core gg device and use it for my client things, or do I need to register the cas on the devices? Help appreciated.

ggainaru · Accepted Answer

As described, it seems your certificates are good - each device has its own set of certificates, generated when the things have been created. You don't need to copy certificates from one device to another.

Here are some things to check:
- Are your client devices associated to the GG core device? Ref. https://docs.aws.amazon.com/greengrass/v2/developerguide/associate-client-devices.html
- Here is how a client device connects to a GG core device with MQTT: https://docs.aws.amazon.com/greengrass/v2/developerguide/connecting-to-mqtt.html
- Please insure the client device auth component (aws.greengrass.clientdevices.Auth) is installed and running on the GG core device. It authenticates client devices and authorizes client device actions. Ref. https://docs.aws.amazon.com/greengrass/v2/developerguide/client-device-auth-component.html#client-device-auth-component-configuration

Which AmazonRootCA1 to use with greengrass ?

관련 콘텐츠