AWS Greengrass Manual Provisioning is failing because of error=TLS (SSL) negotiation failed

Question

following the tutorial on how to install the greengrass service with manual provisioning I keep running into the same error:

`2024-05-31T04:29:03.998Z [ERROR] (AwsEventLoop 2) com.aws.greengrass.mqttclient.AwsIotMqtt5Client: Failed to connect to AWS IoT Core. {clientId=Phil, error=TLS (SSL) negotiation failed}`

I have checked the rootCA, certificate and Private Key allow me to connect to aws using:

```
mosquitto_sub --cafile AmazonRootCA1.pem \
              --cert device.pem.crt \
              --key private.pem.key \
              -h xxxxxxxxx-ats.iot.ap-southeast-2.amazonaws.com \
              -p 8883 \
              -t test/# \
              -d
```

When I run it using automatic provisioning it runs fine and can connect.

```
---
system:
  certificateFilePath: "/gg/v1/certificate.pem.crt"
  privateKeyPath: "/gg/v1/private.pem.key"
  rootCaPath: "/gg/v1/AmazonRootCA1.pem"
  rootpath: "/gg/v1"
  thingName: "Phil"
services:
  aws.greengrass.Nucleus:
    componentType: "NUCLEUS"
    version: "2.12.6"
    configuration:
      awsRegion: "ap-southeast-2"
      iotDataEndpoint: ".iot.ap-southeast-2.amazonaws.com"
      iotCredEndpoint: ".credentials.iot.ap-southeast-2.amazonaws.com"

```

sudo -E java -Droot="/gg/v1" -Dlog.store=FILE \
  -jar /root/installer/lib/Greengrass.jar \
  --init-config /root/installer/config.yaml \
  --component-default-user ggc_user:ggc_group \
  --setup-system-service true
```

What is causing this and how can I fix it or at least see some more of an expanation

Phil · Accepted Answer

After a few hours of scratching my head I realised it was the iotDataEndpoint. I wasn't using the ATS endpoint in my greengrass configuration.

As soon as I updated that the installation worked perfectly.

jrcarb-AWS · Answer

Hi Phil,

Is this error happening during manual provisioning, or after when you tried to connect to IoT Core with an Mqtt client? Can you also check the IoT Policy attached to your Greengrass Core Thing has the proper permissions?
```
{
      "Effect": "Allow",
      "Action": [
        "iot:Publish",
        "iot:Subscribe",
        "iot:Receive",
        "iot:Connect",
        "greengrass:*"
      ],
      "Resource": [
        "*"
      ]
    }
```

AWS Greengrass Manual Provisioning is failing because of error=TLS (SSL) negotiation failed

Add your answer

Relevant content