Blog Post

Internet of Things Blog
5 MIN READ

Azure IoT TLS: Changes are coming! (…and why you should care)

RAMIoT's avatar
RAMIoT
Icon for Microsoft rankMicrosoft
Feb 01, 2021
[Update 5/27/2021: We have published a new blog post with more up-to-date guidance. Please read the new one here]   Microsoft is updating Azure services in a phased manner to use TLS server certi...
Updated May 25, 2022
Version 21.0
azure iot
rajanpatel's avatar
rajanpatel
Copper Contributor
Sep 22, 2020

RAMIoT 

We are using self signed certificate to provision devices into iot hub. Our Device is provisioning to IoT Hub via Azure DPS. We had Azure Device SDK on Device which connect to DPS using global endpoint "global.azure-devices-provisioning.net", ID Scope, and device certificates X.509 (Created using Self Signed Certificate). Once Device is provisioned on Azure IoT Hub using DPS, device will start communicating to IoT hub using device certificates X.509 and Device ID. We hadn't pinned certificates on device.

 

Does is there any impact based on above implementation approach?

 

We also tried to connect to DPS using test environment provided by Azure in this blog. We used our existing device valid certificates which are chaining to self signed root certificate and try to connect with below endpoints. But we are getting error code 401002. Below is the response which we got.

{"errorCode":401002,"trackingId":"****************************","message":"Invalid certificate.","timestampUtc":"2020-09-22T16:26:59.3100404Z"}
  • Azure Test Environment
    • Global Service Endpoint: global-canary.azure-devices-provisioning.net
    • ID SCOPE: 0ne0017FD54

 

What steps we need to follow to prevent disconnection of devices from azure?

 

Thanks,

Rajan