AWS IOT 数据：CERTIFICATE_VERIFY_FAILED

Question

我使用 python + boto3 在 bitbucket 管道中为 AWS IOT 运行测试脚本

直到最近它工作正常，现在我收到以下错误：

Traceback (most recent call last):
  File "/localDebugRepo/tests/aws/test_iot_api.py", line 119, in test_set_get_owner
    self.iot_util.set_owner(owner, self.test_thing)
  File "/localDebugRepo/aws/iot_api.py", line 176, in set_owner
    self.iot_data.update_thing_shadow(thingName=thing, payload=payload)
  File "/usr/local/lib/python3.6/site-packages/botocore/client.py", line 357, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/usr/local/lib/python3.6/site-packages/botocore/client.py", line 663, in _make_api_call
    operation_model, request_dict, request_context)
  File "/usr/local/lib/python3.6/site-packages/botocore/client.py", line 682, in _make_request
    return self._endpoint.make_request(operation_model, request_dict)
  File "/usr/local/lib/python3.6/site-packages/botocore/endpoint.py", line 102, in make_request
    return self._send_request(request_dict, operation_model)
  File "/usr/local/lib/python3.6/site-packages/botocore/endpoint.py", line 137, in _send_request
    success_response, exception):
  File "/usr/local/lib/python3.6/site-packages/botocore/endpoint.py", line 256, in _needs_retry
    caught_exception=caught_exception, request_dict=request_dict)
  File "/usr/local/lib/python3.6/site-packages/botocore/hooks.py", line 356, in emit
    return self._emitter.emit(aliased_event_name, **kwargs)
  File "/usr/local/lib/python3.6/site-packages/botocore/hooks.py", line 228, in emit
    return self._emit(event_name, kwargs)
  File "/usr/local/lib/python3.6/site-packages/botocore/hooks.py", line 211, in _emit
    response = handler(**kwargs)
  File "/usr/local/lib/python3.6/site-packages/botocore/retryhandler.py", line 183, in __call__
    if self._checker(attempts, response, caught_exception):
  File "/usr/local/lib/python3.6/site-packages/botocore/retryhandler.py", line 251, in __call__
    caught_exception)
  File "/usr/local/lib/python3.6/site-packages/botocore/retryhandler.py", line 277, in _should_retry
    return self._checker(attempt_number, response, caught_exception)
  File "/usr/local/lib/python3.6/site-packages/botocore/retryhandler.py", line 317, in __call__
    caught_exception)
  File "/usr/local/lib/python3.6/site-packages/botocore/retryhandler.py", line 223, in __call__
    attempt_number, caught_exception)
  File "/usr/local/lib/python3.6/site-packages/botocore/retryhandler.py", line 359, in _check_caught_exception
    raise caught_exception
  File "/usr/local/lib/python3.6/site-packages/botocore/endpoint.py", line 200, in _do_get_response
    http_response = self._send(request)
  File "/usr/local/lib/python3.6/site-packages/botocore/endpoint.py", line 269, in _send
    return self.http_session.send(request)
  File "/usr/local/lib/python3.6/site-packages/botocore/httpsession.py", line 281, in send
    raise SSLError(endpoint_url=request.url, error=e)
botocore.exceptions.SSLError: SSL validation failed for https://data.iot.eu-central-1.amazonaws.com/things/thing-unittest/shadow [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:777)

虽然我无法在本地系统上重现此问题，但使用默认 python:3.6.4 docker 映像重现错误是成功的，表明可能存在无效证书。

有趣的是，在管道中运行以下命令是成功的： openssl s_client -connect data.iot.eu-central-1.amazonaws.com:443

root@f30a34330be5:/localDebugRepo# openssl s_client -connect data.iot.eu-central-1.amazonaws.com:443
CONNECTED(00000003)
depth=2 C = US, O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "(c) 2006 VeriSign, Inc. - For authorized use only", CN = VeriSign Class 3 Public Primary Certification Authority - G5
verify return:1
depth=1 C = US, O = Symantec Corporation, OU = Symantec Trust Network, CN = Symantec Class 3 Secure Server CA - G4
verify return:1
depth=0 C = US, ST = Washington, L = Seattle, O = "Amazon.com, Inc.", CN = *.iot.eu-central-1.amazonaws.com
verify return:1
140686038922896:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:177:
---
Certificate chain
 0 s:/C=US/ST=Washington/L=Seattle/O=Amazon.com, Inc./CN=*.iot.eu-central-1.amazonaws.com
   i:/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 Secure Server CA - G4
 1 s:/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 Secure Server CA - G4
   i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5
---

任何关于如何进一步调试的建议将不胜感激

Answer 1

AWS 在过去几个小时内似乎有错误的证书。 我没有订阅支持层，所以我不知道如何告诉他们。 我遇到了同样的问题； boto3 报告错误的证书（您可以在浏览器中验证）。

我的所有 IoT 功能都会受到影响，但如果我在本地运行它（而不是作为 lambda），它似乎可以工作。

也许有人有办法告诉亚马逊他们的小问题？

编辑：

见： https://forums.aws.amazon.com/thread.jspa?messageID=967311&#967311 和 https://github.com/boto/boto3/issues/2686 修复。您不应使用默认值来创建数据平面客户端，因为已修复 certifi (python) 以忽略 URL 的 Symantec CA，而 Amazon 不会修复它。

Answer 2

Eric Lyons 指出的解决方案对我没有直接作用。问题出在以下提供的端点上：

iot_client = boto3.client("iot", region_name=os.getenv("IOT_REGION"))
iot_client.describe_endpoint(endpointType="iot:Data-ATS").get("endpointAddress")

身份验证失败：

我通过直接从 IOT-Core 设置页面获取端点来修复它：

client('iot-data',
       aws_access_key_id     = '<MY ACCESS KEY>',
       aws_secret_access_key = '<MY ACCESS SECRET KEY>',
       endpoint_url          = '<MY ENDPOINT>');