Can we have JITP enabled for IOT devices connecting to AWS greengrass core ?

The short answer is no. JITP registers a device in the AWS IoT Core registry when it first connects to AWS IoT Core. Even if your device could connect to the Greengrass MQTT broker first, the MQTT Connect message doesn't get sent to AWS IoT Core. Also, for the client devices feature to work, your device needs to be already registered in AWS IoT Core to allow your device to authenticate to the EMQX or Moquette broker.

Do your devices have a network pathway to AWS IoT Core? If so, one workflow would be to connect to AWS IoT Core when first unboxed, and allow JITP to occur. Then use Greengrass discovery to look up the connection details for the Greengrass device they should connect to.

• https://docs.aws.amazon.com/whitepapers/latest/device-manufacturing-provisioning/provisioning-identity-in-aws-iot-core-for-device-connections.html#just-in-time-provisioning
• https://docs.aws.amazon.com/greengrass/v2/developerguide/greengrass-discover-api.html
• https://docs.aws.amazon.com/greengrass/v2/developerguide/interact-with-local-iot-devices.html
• https://aws.amazon.com/blogs/iot/implementing-local-client-devices-with-aws-iot-greengrass/

If your devices don't have a pathway to AWS IoT Core, then you should register them in AWS IoT Core before they are unboxed. And use your own CA (because your devices can't perform discovery to retrieve the CA): https://docs.aws.amazon.com/greengrass/v2/developerguide/connecting-to-mqtt.html#use-your-own-CA