Azure-iot-sdk-c: IoT Hub root CAs

[kskog]

We have noticed that our iot-hub presents a server certificate with a chain ending in Baltimore CyberTrust Root. When I read blogs about this, it seems like this is the root certificate for all IoT Hubs.

Then, why are there 3 root CA certificates in the code?
Are some IoT Hubs presenting a certificate signed by one of the other CAs?

The question really is, for our IoT Hub instance, do we need to include all 3 CA certificates to ensure we are able to communicate?

[danewalton]

Hi @kskog
The short answer to your question is yes. All three certs are required to validate the chain of trust from the client side (I emphasize chain because we need to validate each cert presented not just the Microsoft cert). Here is a link better describing the idea behind a certificate chain of trust if you would like a more in depth answer.

[anhashia]

Hi @kskog

I assume you are referring to list https://github.com/Azure/azure-iot-sdk-c/blob/master/certs/certs.c
DigiCert Baltimore Root is trusted root for IoT Hub hostnames ending with *.azure-devices.net.

• IoT hub service is also supported in Azure national clouds. These hostnames will be different and they will be secure by different Root CA's. That is why there are other Roots CA's in the file.

If you IoT Hub hostname ends is .azure-devices.net, then you only need DigiCert Baltimore Root CA

[kskog]

Thanks @anhashia

That was helpful:-)
Our hostname ends in .azure-devices.net.

[danewalton]

I stand corrected. Thanks for the input @anhashia!

I will go ahead and close this since the original question seems to be answered. Feel free to open another issue if you have other questions!

[az-iot-builder-01]

@danewalton, @kskog, thank you for your contribution to our open-sourced project! Please help us improve by filling out this 2-minute customer satisfaction survey