Azure-iot-sdk-csharp: Register a device using my certificates and get IotHubUnauthorizedAccess error

[luyaok]

I followed this tutorial

And generate certificates followed this document.

My device certificate signed by the root certificate that I upload to my IoT Hub and verified successfully. In DPS, I create an individual enrollment and upload my device public key certificate.

Then I run the ProvisioningDeviceClientX509 sample and get the error at this line:
DeviceRegistrationResult result = await provClient.RegisterAsync();

This is the log:

D:\azure-iot-sdk-csharp\provisioning\device\samples\ProvisioningDeviceClientX509>dotnet run 0ne000095C1
RegistrationID = CN=ritatestdevice
ProvisioningClient RegisterAsync . . .
Unhandled Exception: Microsoft.Azure.Devices.Provisioning.Client.ProvisioningTransportException: AMQP transport exception ---> Microsoft.Azure.Amqp.AmqpException: {"errorCode":401002,"trackingId":"a440159d240b412196a58e76938533f9-G:0-TimeStamp:01/23/2018 08:30:19","message":"IotHubUnauthorizedAccess","timestampUtc":"2018-01-23T08:30:19.3019521Z"}
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Microsoft.Azure.Amqp.ExceptionDispatcher.Throw(Exception exception)
   at Microsoft.Azure.Amqp.AsyncResult.End[TAsyncResult](IAsyncResult result)
   at Microsoft.Azure.Amqp.AmqpObject.OpenAsyncResult.End(IAsyncResult result)
   at Microsoft.Azure.Amqp.AmqpObject.EndOpen(IAsyncResult result)
   at System.Threading.Tasks.TaskFactory`1.FromAsyncCoreLogic(IAsyncResult iar, Func`2 endFunction, Action`1 endAction, Task`1 promise, Boolean requiresSynchronization)
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.AmqpClientLink.<OpenAsync>d__14.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.<CreateLinksAsync>d__8.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.<RegisterAsync>d__7.MoveNext()
   --- End of inner exception stack trace ---
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.<RegisterAsync>d__7.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at ProvisioningDeviceClientX509.Program.<RunSample>d__3.MoveNext() in D:\azure-iot-sdk-csharp\provisioning\device\samples\ProvisioningDeviceClientX509\Program.cs:line 44
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at ProvisioningDeviceClientX509.Program.Main(String[] args) in D:\azure-iot-sdk-csharp\provisioning\device\samples\ProvisioningDeviceClientX509\Program.cs:line 77

This is my code:

        public static async Task RunSample(X509Certificate2 certificate)
        {
            var myCertificate = new X509Certificate2("ritatestdevice.pfx", "123");
            using (var security = new SecurityProviderX509Certificate(myCertificate))
            using (var transport = new ProvisioningTransportHandlerAmqp(TransportFallbackType.TcpOnly))
            {
                ProvisioningDeviceClient provClient = 
                    ProvisioningDeviceClient.Create(GlobalDeviceEndpoint, s_idScope, security, transport);

                Console.WriteLine($"RegistrationID = {security.GetRegistrationID()}");
                Console.Write("ProvisioningClient RegisterAsync . . . ");
                DeviceRegistrationResult result = await provClient.RegisterAsync();

                Console.WriteLine($"{result.Status}");
                Console.WriteLine($"ProvisioningClient AssignedHub: {result.AssignedHub}; DeviceID: {result.DeviceId}");

                if (result.Status != ProvisioningRegistrationStatusType.Assigned) return;

                IAuthenticationMethod auth = new DeviceAuthenticationWithX509Certificate(result.DeviceId, certificate);
                using (DeviceClient iotClient = DeviceClient.Create(result.AssignedHub, auth))
                {
                    Console.WriteLine("DeviceClient OpenAsync.");
                    await iotClient.OpenAsync();
                    Console.WriteLine("DeviceClient SendEventAsync.");
                    await iotClient.SendEventAsync(new Message(Encoding.UTF8.GetBytes("TestMessage")));
                    Console.WriteLine("DeviceClient CloseAsync.");
                    await iotClient.CloseAsync();
                }
            }
        }

[amogh79]

Try re-provisioning your IoT hub. I had the same issue after the IoT hub I was connecting was deployed using ARM by the CI-CD folks. Asked them to recreate and my problem was resolved.

[CIPop]

@simonporter @alextolp Sounds like there is a bug in the service. @JimacoMS2 was hitting something similar yesterday.

[CIPop]

@luyaok I've found and fixed this issue with the certificates generated by the tool: https://github.com/Azure/azure-iot-sdk-c/pull/365
Please download the updated powershell script and regenerate the certificates.

If you're still hitting this, please reopen. As @amogh79 pointed out, you may need to either remove all previously uploaded certificates or recreate the hub.

[DataWerkt]

I've hit this one as well after using these instructions: https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-security-x509-create-certificates to create group enrollment certificates.

Should these group certificates be changed in order to work as well?

[CIPop]

@DataWerkt thanks for reporting this! I wasn't aware of that doc.
Could you give the instructions in this repo a try (using the C SDK cert generation tool instead) and let us know if you see any issues?

@nberdy @yzhong94 @dominicbetts @jspaith I'm not very sure about the doc @DataWerkt pointed above would work for DPS - I've never tested that before. Could we instead point to the C-repo tool?

[DataWerkt]

Hi CIPop,

I've managed to get the certifcates installed with the C SDK cert generation tool. Unfortunately the result is still the same:

Enter the PFX password for C:\Users\MatthijsHoogwerf\azure-iot-sdk-c\tools\CACertificates\TestDevice1.pfx:

Found certificate: BAFC3540746261DDD6F347B54475D38E47D8B8ED CN=Azure IoT CA TestOnly Root CA; PrivateKey: False
Found certificate: B8059A3D2F001AE6BE4DEFB5AFB63EBACB60B035 CN=TestDevice1; PrivateKey: True
Using certificate B8059A3D2F001AE6BE4DEFB5AFB63EBACB60B035 CN=TestDevice1
RegistrationID = TestDevice1
ProvisioningClient RegisterAsync . . .
Unhandled Exception: Microsoft.Azure.Devices.Provisioning.Client.ProvisioningTransportException: AMQP transport exception: service error.
Service Error: 400004 - BadRequest (TrackingID: 1b4631cd468447a5915d235c47fe4bc5-G:0-TimeStamp:07/03/2018 09:08:00 Time: 2018-07-03T09:08:00.7520099Z)

   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.ValidateOutcome(Outcome outcome)
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.<RegisterDeviceAsync>d__9.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.Azure.Devices.Provisioning.Client.Transport.ProvisioningTransportHandlerAmqp.<RegisterAsync>d__7.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at ProvisioningDeviceClientX509.Program.<RunSample>d__3.MoveNext() in C:\Users\MatthijsHoogwerf\azure-iot-sdk-csharp\provisioning\device\samples\ProvisioningDeviceClientX509\Program.cs:line 45
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at ProvisioningDeviceClientX509.Program.Main(String[] args) in C:\Users\MatthijsHoogwerf\azure-iot-sdk-csharp\provisioning\device\samples\ProvisioningDeviceClientX509\Program.cs:line 105

See attached document for the complete set of steps taken.

(C SDK) Certificate installation steps and (C# SDK) device provisioning.docx

[CIPop]

@DataWerkt please open a new bug or, even better, a support ticket so we can take a look at the service side logs as well. (see here for support details)

I believe you're using the right certificate but observing a different issue.

[yzhong94]

@DataWerkt Just to confirm, did you add your CA cert to DPS? https://docs.microsoft.com/en-us/azure/iot-dps/tutorial-group-enrollments

[DataWerkt]

@yzhong94 Yes I did and verified it successfully. As requested by CIPop I opened a new issue here https://github.com/Azure/azure-iot-sdk-csharp/issues/547