I'm trying to determine whether AWS IoT Greengrass v2 requires internet connectivity to rotate the local MQTT server certificate. Connectivity is explicitly required in GGv1 but does not appear to be explicitly documented in GGv2.
GGv1 docs
In GGv1, the requirement is explicit (source):
"The MQTT server certificate is signed by the group CA certificate, which is stored in the cloud. For certificate rotation to occur, your Greengrass core device must be online and able to access the AWS IoT Greengrass service directly on a regular basis."
GGv2 docs
The GGv2 docs describe the mechanism but never explicitly address whether internet is required.
From connecting-to-mqtt:
"The client device auth component issues an X.509 certificate using the core device CA. The certificate is rotated when the broker starts, when the certificate expires, or when connectivity information such as the IP address changes."
From device-auth:
"This certificate is signed by the core device CA certificate, which the core device stores in the AWS IoT Greengrass cloud."
The CA is described as being stored in the cloud, which implies rotation might require cloud access. However, empirical testing (below) suggests otherwise.
What I found empirically
Inspecting the file system, the core device CA appears to be cached locally:
/greengrass/v2/work/aws.greengrass.clientdevices.Auth/
ca.jks
ca.pem
clients/
Testing performed (all with internet disconnected)
- Restarted the Greengrass service — client devices reconnected successfully
- Restarted only the Moquette component — client devices reconnected successfully
- Deleted
keystore.jks and restarted Moquette — file was recreated, client devices reconnected successfully
- Modified the Auth component IP configuration via the Debug Console — caused Moquette to restart, client devices reconnected successfully
In all tests, client devices were able to connect to the core offline (all devices were previously connected with cloud connection to initialize client trust).
Questions
- Does GGv2 MQTT server certificate rotation require internet connectivity? My testing suggests no, but the docs describe the core CA as stored "in the AWS IoT Greengrass cloud".
- Is this offline cert rotation behavior guaranteed and supported, or is it an undocumented side effect that could change in a future release?
Testing Configuration
| Parameter | Value |
|---|
serverCertificateValiditySeconds | 864000 (10 days, maximum) |
clientDeviceTrustDurationMinutes | 2147480000 |
| aws.greengrass.clientdevices.Auth | v2.5.5 |
| aws.greengrass.clientdevices.mqtt.Moquette | v2.3.7 |
Thank you!
