aws auth_error ai_generated true

MQTT connection failed: certificate not active or not attached to a thing/policy

ID: aws/aws-iot-certificate-error

Also available as: JSON · Markdown
85%Fix Rate
87%Confidence
45Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
2 active — — —

Root Cause

IoT device cannot connect because the certificate is inactive, not attached to a thing, or missing a policy.

generic

Workarounds

  1. 90% success Activate the certificate and attach it to both a thing and a policy 
    aws iot update-certificate --certificate-id ID --new-status ACTIVE && aws iot attach-thing-principal && aws iot attach-policy

    Sources: https://docs.aws.amazon.com/iot/latest/developerguide/create-iot-resources.html

  2. 82% success Verify the IoT policy allows the required MQTT actions on the correct topic ARNs 
    aws iot get-policy --policy-name POLICY to check iot:Connect, iot:Publish, iot:Subscribe, iot:Receive actions

    Sources: https://docs.aws.amazon.com/iot/latest/developerguide/iot-policies.html

Dead Ends

Common approaches that don't work:

  1. Generate new certificates without deactivating the old ones 65% fail

    Old certificates remain active and create security risk; new certs need same policy attachment

  2. Use IAM credentials instead of certificates for IoT devices 85% fail

    IoT Core primarily uses X.509 certificates for device auth; IAM is for management plane only

Error Chain

Leads to:
Preceded by:
Frequently confused with: