Obtaining a permanent certificate for Greengras IOT Device

Hello everyone,

I am currently working on connecting various devices to AWS via Greengras IOT. The Greengras components are running in Docker containers. However, I am currently having problems with the certificates.

At first I “only” worked with claim certificates, but had the problem that these are only valid for 24 hours and are not valid for reconnecting to AWS if there is an interruption. That's why I'm trying to create permanent certificates after registering with the calim certificates, but unfortunately I'm not getting anywhere.

Does anyone have a best practice with Docker and Greengras IOT on the subject of permanent certificates?

Here is a part of my current approach as a bash script, but it does not work as desired:

check_device_registration() {
    echo "Checking if the device is registered..."

    # Extract Thing Name from config.yaml
    thingName=$(grep 'ThingName:' "$CONFIG_FILE" | awk '{print $2}' | tr -d '"')

    if [ -z "$thingName" ]; then
        echo "Error: ThingName could not be extracted from $CONFIG_FILE."
        exit 1
    fi

    # Check the status of the device
    deviceStatus=$(aws iot describe-thing --thing-name "$thingName" --query 'thingTypeName' --output text 2>/dev/null || echo "NOT_FOUND")
    
    echo "Device status: $deviceStatus"

    if [ "$deviceStatus" = "NOT_FOUND" ]; then
        echo "The device is not yet registered. Waiting for registration..."
        return 1
    fi

    echo "The device is registered. Status: $deviceStatus"
    return 0
}

 Function to provision the permanent certificate
provision_permanent_certificate() {
    echo "Requesting permanent certificate..."

    # Device must be registered
    if ! check_device_registration; then
        echo "The device is not registered. Starting Greengrass for initial registration..."
        start_greengrass_initial
        if ! check_device_registration; then
            echo "Registration failed. Check the Greengrass configuration."
            exit 1
        fi
    fi

    MQTT_PUB_TOPIC="$aws/certificates/create/json"
    MQTT_SUB_TOPIC="$aws/certificates/create/accepted"
    ERROR_TOPIC="$aws/certificates/create/rejected"

    iotDataEndpoint=$(grep 'iotDataEndpoint:' "$CONFIG_FILE" | awk '{print $2}' | tr -d '"')

    if [ -z "$iotDataEndpoint" ]; then
        echo "Error: iotDataEndpoint could not be extracted from $CONFIG_FILE."
        exit 1
    fi

    echo "IoT Data Endpoint: $iotDataEndpoint"

    # Request certificate via MQTT
    mosquitto_pub \
        --cafile /greengrass-setup/AmazonRootCA1.pem \
        --cert "$CLAIM_CERT_PATH" \
        --key "$CLAIM_CERT_PATH" \
        -h "$iotDataEndpoint" \
        -p 8883 \
        -q 1 \
        -t "$MQTT_PUB_TOPIC" \
        -m "{}"

    echo "Waiting for response from AWS IoT Core..."

    mosquitto_sub \
        --cafile /greengrass-setup/AmazonRootCA1.pem \
        --cert "$CLAIM_CERT_PATH" \
        --key "$CLAIM_CERT_PATH" \
        -h "$iotDataEndpoint" \
        -p 8883 \
        -q 1 \
        -t "$MQTT_SUB_TOPIC" \
        -t "$ERROR_TOPIC" \
        | while read -r payload; do
            echo "Response received: $payload"
            if [[ "$payload" == *"certificatePem"* ]]; then
                echo "$payload" | jq -r '.certificatePem' > "$PERMANENT_CERT_PATH"
                echo "$payload" | jq -r '.privateKey' > "$PERMANENT_KEY_PATH"
                echo "Permanent certificate successfully created."
                break
            elif [[ "$payload" == *"errorMessage"* ]]; then
                echo "Error creating certificate: $payload"
                exit 1
            fi
        done
}

# Function to update `config.yaml` with permanent certificates
update_config_with_permanent_certificate() {
    echo "Updating configuration in $CONFIG_FILE..."

    # Ensure the file exists
    if [ ! -f "$CONFIG_FILE" ]; then
        echo "Error: $CONFIG_FILE not found."
        exit 1
    fi

    # Update certificate and key paths in `config.yaml`
    sed -i "s|claimCertificatePath:.*|claimCertificatePath: \"$PERMANENT_CERT_PATH\"|" "$CONFIG_FILE"
    sed -i "s|claimCertificatePrivateKeyPath:.*|claimCertificatePrivateKeyPath: \"$PERMANENT_KEY_PATH\"|" "$CONFIG_FILE"

    echo "Configuration updated successfully."

    # Restart Greengrass Nucleus
    restart_greengrass
}

if [ ! -d $GGC_ROOT_PATH/alts/current/distro ]; then
    # Install Greengrass via the main installer, but do not start running
    echo "Installing Greengrass for the first time..."
    parse_options
    start_greengrass_initial
else
    echo "Reusing existing Greengrass installation..."
fi

# Make loader script executable
echo "Making loader script executable..."
chmod +x $GGC_ROOT_PATH/alts/current/distro/bin/loader

echo "Starting Greengrass..."

# Start greengrass kernel via the loader script and register container as a thing
exec $GGC_ROOT_PATH/alts/current/distro/bin/loader &

# Background process for certificate provisioning and configuration update
(
    # Wait time to ensure that the Greengrass kernel has started and the device has been activated
    sleep 30

    # Provision the permanent certificate
    provision_permanent_certificate

    # Update the configuration with the permanent certificate
    update_config_with_permanent_certificate
) &

# Wait for the Greengrass kernel process
wait