Aws-sdk-ios: AWS IoT requires using of `-ats.xxx.xxx` endpoints.

[MrLiuYunPing]

Describe the bug
mqtt cannot connected in IOS 12.1.1 ,and it is normal in lower version.

To Reproduce
Steps to reproduce the behavior:

Which AWS service(s) are affected?
Iot
Expected behavior

Screenshots
Connecting...
2018-12-06 20:04:24:347 IoTSampleSwift[1120:38283] username is : ?SDK=iOS&Version=2.6.19
2018-12-06 20:04:24:347 IoTSampleSwift[1120:38283] Metrics collection is: Enabled
2018-12-06 20:04:24:352 IoTSampleSwift[1120:38623] <<{number = 20, name = (null)}>> Initializing MQTTEncoder and MQTTDecoder streams
2018-12-06 20:04:24:353 IoTSampleSwift[1120:38623] opening encoder stream.
2018-12-06 20:04:24:353 IoTSampleSwift[1120:38623] opening decoder stream.
2018-12-06 20:04:24.976071+0800 IoTSampleSwift[1120:38623] CFNetwork SSLHandshake failed (-9807)
2018-12-06 20:04:24.976169+0800 IoTSampleSwift[1120:38623] TCP Conn 0x28281b600 SSLHandshake failed (-9807)
2018-12-06 20:04:24:976 IoTSampleSwift[1120:38623] MQTT session error, code: 3
2018-12-06 20:04:24:977 IoTSampleSwift[1120:38623] closing encoder stream.
2018-12-06 20:04:24:977 IoTSampleSwift[1120:38623] closing decoder stream.
2018-12-06 20:04:25:983 IoTSampleSwift[1120:38623] MQTTSessionEventConnectionError: Received an MQTT session connection error
connection status = 5
Connection Error
2018-12-06 20:06:33:987 IoTSampleSwift[1120:38633] Attempting to reconnect.
connection status = 1
Connecting...
2018-12-06 20:06:33:988 IoTSampleSwift[1120:38633] username is : ?SDK=iOS&Version=2.6.19
2018-12-06 20:06:33:988 IoTSampleSwift[1120:

Environment(please complete the following information):

• SDK Version: 'AWSIoT', '~> 2.7.3'
• Dependency Manager: Cocoapods
• Swift Version : [e.g. 4.0]

Device Information (please complete the following information):

• Device: 7Plus iPhone X
• iOS Version:12.1.1
• Specific to simulators:

Additional context
Add any other context about the problem here.

[MrLiuYunPing]

any one see the issue?

[BronzeWareH]

I can repro this issue. @rohandubal , Can you help to assign someone to follow up?

[MrLiuYunPing]

@

[cbommas]

@MrLiuYunPing, @BronzeWareH

Sorry to hear you are running into issues. I will look into this and get back to you. One quick thing to check - is your MQTT endpoint configured with an Amazon Trust Services certificate? The easiest way to check is to see if your endpoint has a -ats or .ats in it.

If it is not, then can you go to the AWS Console->IoT Core ->Settings page and use the URL present there _( ATS configured URLs have been setup for you by default)_

[MrLiuYunPing]

OK I will try as the way you have provided !Thank you for your suggestions! Can you repro this issue?

[johnflanagan-spok]

I'm having the same issue. The endpoint we're using ends with -ats.iot.us-east-1.amazonaws.com

[cbommas]

@MrLiuYunPing @johnflanagan-spok @BronzeWareH

@rohandubal and I tried to reproduce this on our side, but did not encounter the problem on either an iOS 12.1 simulator or a physical device running 12.1.1.

It will be helpful if you can try this on a physical device running 12.1.1 and let us know how it goes.

Also, can you let me know how you got hold of a 12.1.1 simulator? I have the latest XCode and it only has options for 12.1

[arrow53]

Same issue. I'm on west-2. Works fine on simulator (12.1) and devices I haven't upgraded yet (still on 12.1) but soon as you go to 12.1.1 you're sunk.

[cbommas]

@arrow53
Is your endpoint configured with an ATS certificate. See my post earlier in this thread on how to verify.

Also, can you post your logs from running this on a 12.1.1 physical device?

[arrow53]

@cbommas haha yeah, you're right. That's all it was. I just needed to update the endpoint. Thanks!

[cbommas]

@arrow53
good to hear! thank you for letting me know.

@MrLiuYunPing @BronzeWareH @johnflanagan-spok
Can you also validate on your side please

[ufosaga]

@cbommas
Problem solved by using the new endpoints.
In us-east Virginia it is '-ats', in cn-north Beijing it is '.ats'

[XQ-Huang]

@cbommas It's ok, Thanks

[MrLiuYunPing]

thank you ，my problem is resolved!@cbommas

[cbommas]

Thank you all.

[johnflanagan-spok]

@cbommas I'm still getting an SSLHandshake failed error.

Our IoTCore endpoint contains -ats, but it doesn't look like it's even getting far enough to attempt to reach that address. It's failing trying to connect to wss://data.iot.us-east-1.amazonaws.com/mqtt?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=... at https://github.com/aws-amplify/aws-sdk-ios/blob/c60cfce7e2445668fc631418ac3be1624b729c62/AWSIoT/Internal/AWSIoTMQTTClient.m#L451

[cbommas]

@johnflanagan-spok

It appears that it still connecting to the non ATS endpoint. It could be that your configuration is still pointing to the old URL. Can you share a code snippet on how you are configuring and instantiating the IoT client?

Also, can you make sure that you have followed the steps to configure the client as documented here - https://aws-amplify.github.io/docs/ios/pubsub.

I will reopen this thread to make sure that we can track this issue appropriately.

[johnflanagan-spok]

@cbommas

I wasn't explicitly setting the endpoint in the AWSServiceConfiguration. I've set that and it looks to be working now. Thanks!

[cbommas]

Excellent. Thank you for confirming.

[Wanxujie]

Same issue. I have used the ats.xxx.xxx endpoint, useast1

[Wanxujie]

@cbommas Should I need insert RootCA to iOS Application?

[johnflanagan-spok]

@Wanxujie I didn't need to install a certificate. The mistake I was making was not explicitly supplying an endpoint to initialize AWSServiceConfiguration. I changed my code from:

AWSServiceConfiguration(region: config.region, credentialsProvider: credentialProvider)

to

let endpoint = AWSEndpoint(urlString: "wss://\(environment.iotEndpoint)")
AWSServiceConfiguration(region: config.region, endpoint: endpoint, credentialsProvider: self.credentialProvider)

and that fixed it for me. (obviously config and environment were coming in form somewhere else)

[cbommas]

@johnflanagan-spok

Thanks for helping with this.

@Wanxujie
can you confirm if that fixes your issue. Otherwise, please open a new issue so that we can track it and get it addressed for you.

[NaiyerAghaz]

@MrLiuYunPing, @BronzeWareH

Sorry to hear you are running into issues. I will look into this and get back to you. One quick thing to check - is your MQTT endpoint configured with an Amazon Trust Services certificate? The easiest way to check is to see if your endpoint has a -ats or .ats in it.

If it is not, then can you go to the AWS Console->IoT Core ->Settings page and use the URL present there _( ATS configured URLs have been setup for you by default)_

thanks brother error has fixed.

[cypcap]

I fixed issue by using -ats.iot.us-east-1.amazonaws.com. Thanks

[twinklesaini1996]

hi I am still getting this error in my app

[twinklesaini1996]

I fixed issue by using -ats.iot.us-east-1.amazonaws.com.
hi
can you help me to fix this issue