AWSCRT (AWS IoT) TLS Negotiation timeout Python

Viewed 1962

I am establishing an IoT Connection (MQTT) using AWS IoT Device SDK Python (sudo pip install awsiotsdk && python -m pip install awscrt). It works well using WiFi on my Raspbian device.

When using a GSM module I receive below error after ~5-6s:

'aws.crt.exceptions.AwsCrtError: AwsCrtError(name='AWS_IO_TLS_NEGOTIATION_TIMEOUT', message='Channel shutdown due to tls negotiation timeout', code=1068).

So I tried telnet to see if that works, which was successful:

host$> telnet <prefix>.iot.<region>.amazonaws.com 8883
Trying 54.123.456.103...
Connected to <endpoint>.
Escape character is '^]'.

I tried openssl to see that I could establish a connection, which was successful:

openssl s_client -connect <prefix>.iot.<region>.amazonaws.com:8883 -tls1_2 -CAfile <path to Root CA cert> -cert <Path to device cert> -key <Path to device private key>

I increased all the timeouts in the code & libraries, e.g. ping_timout_ms from 5s -> 30s. This did not help.

keep_alive_secs=kwargs.get('keep_alive_secs', 1200),
ping_timeout_ms=kwargs.get('ping_timeout_ms', 30000)

I do not know what else I can do to troubleshoot this. Nor can I find any useful information when searching. Looking for advice!


Adding additional info, full run ~15sec. I added some print() in the code to better understand what's happening.

Import awscrt and awsiot
concurrent/futures/_base.Future
concurrent/futures/_base.Future.Executor
mqtt.Client
mqtt.Connection
main.py - Parameters
main.py - Define global parameters..
main.py - Main started!
awsiot_mqtt_connection_builder.mtls_from_path
awsiot_mqtt_connection_builder._builder
awsiot_mqtt_connection_builder._builder.ca_filepath
ca_dirpath: None ca_filepath: /cert/AmazonRootCA1.pem
awsiot_mqtt_connection_builder._builder.not_use_websocket
awscrt/io.is_alpn_available
awsiot_mqtt_connection_builder._builder.not_use_websocket.alpn_available
Port: 443
awsiot_mqtt_connection_builder._get_metrics_str
mqtt.Client.__init__
mqtt.Connection.__init__
Connecting to xxxxxxxxxx-ats.iot.eu-west-1.amazonaws.com with client ID '<string>'
mqtt.connect started..
<awscrt.mqtt.Connection object at 0xb47c3788>
_base.Future.__init__ started...
concurrent/futures/_base.Future.__repr__
<Future at 0xb4758330 state=pending>
mqtt.connect.try
self.keep_alive_secs: 240 self.ping_timeout_ms: 50000
concurrent/futures/_base.Future.result
mqtt.connect.on_connect started..
Error code
1067
_base.Future.set_exception started...
_base.Future.set_exception_info started...
concurrent/futures/_base.Future.__get_result
concurrent/futures/_base.Future._invoke_callbacks
1 Answers

I had a similar problem and found out that the TLS negotiation timeout is hard-coded and set to 4 seconds in aws-io-c library. I created this GitHub issue, containing the needed background, in order to expose this parameter to awscrt as well: https://github.com/awslabs/aws-crt-python/issues/173

Related