The remote certificate is invalid according to the validation procedure

Question

Hi,

We are currently using a symmetric key to authenticate the devices and these devices are working fine but today at one of the devices we get the following exception:

Failed to connect: System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

Afterward, the connection was lost, and when we tried to re-connect it prompted for a new certificate after which we were able to re-connect.

Any idea what can be the reason for it and how can we avoid it in the future?

Regards,
Ali Qureshi

Answer 1

Hello @Ali Akbar Qureshi ,

is this issue related to an Edge device? Can this be related to this?

Azure IoT Edge uses a separate certificate for securing inter-module communication (together with the edgehub module).

A 'development' certificate is created by default. This certificate is only valid for 90 days. A restart of the device will generate a new certificate (again valid for 90 days only).

You need to replace this certificate with a 'production' certificate.

Please run

sudo iotedge check  

for more informaton.

Answer 2

Hello @Ali Akbar Qureshi ,

Adding few more points to Sander's response.

Recommended Steps

• Run iotedge check. This tool has specific checks and recommendations for certificate settings.
• Make sure the hostname setting in /etc/iotedge/config.yaml is a hostname and not an ip address.
• Update the iotedge runtime to latest

Recommended Documents
Understand how Azure IoT Edge uses certificates.

Question: In case of certificate expiry, why does the edgeHub , runtime and other modules do not stop working.
"The Edge Hub does not proactively drop established connections when its certificate expires. Any client that successfully connected before the new certificate expired would continue to send data."

Question: IoT Edge Runtime creates

• Workload CA certificate with expiry of 1 year
• Server Certificate with expiry of 90 days

Now it is expected that after 90 days the Server Certificate should get regenerated or renewed by IoT Edge Runtime and IoT edgeHub?

Yes, it should be automatic.

Please comment in the below section so that we can help you further.