AVNET's iotconnect.io cloud platform is an online service that you can use to send data to, and then show it on a dashboard. In this blog series I'm learning how to talk to it with Node-RED. In this post: authentication with a Self Signed Certificate. This is a good step forward in the safety, but not as good as proper CA certificates. That will be covered in a next post.

Scenario:

I want to improve authentication safety.

In all the previous posts, I used the customer id (CPID) and device unique ID.

Now I'll use additional verification: certificates.

They are self-signed, generated by the AVNET IoTConnect server.

In node-red, I'll use these certificates when making the connection. They must be valid and have to match the ones linked to the device.

Steps:

Generate an IoTConnect template with security option: Self Signed.

Generate a new Device, and link it to that template. The server will generate the certificates for us at that point.

Save the 3 components that are needed, as text files:

• root certificate,
• device certificate and
• device private key,

Create a Node-RED flow to test this, and try.

The complexity of this scenario is low. Everything is prepared for you.

Create Template with Self Signed Certificate authentication

Save, Then add at least one attribute. I've been using Temperature in all the previous posts. I'll stick to it.

Save. You now have a minimal working template set up for self signed certificate authentication.

Create Device and Get the Certificates

You can now create a device, using that template.

Because the template is set up for self signed certificate authentication, the portal will create the certificates chain and keys now.

Don't forget to click on the certificate icon and get all the info. This is the only chance.

The system asks you to generate a password for the certificates.

Enter one, press Generate.

A pop-up shows with all the info needed to connect.

This is linked to your device on the cloud. You have to use this certificate collection to log on from Node-RED, or the connection will fail (and that is good).

You end up with 3 files:

• client.key (key),
• client.pem (cert),
• CA.pem (root certificate)

They have to be available to Node-RED.

I placed those on the client that's running Node-RED ('"the device", an AVNET Smartedge IIOTGateway):

/home/avnet/.iotconnect/.selfsigned/client.key

/home/avnet/.iotconnect/.selfsigned/client.pem

/home/avnet/.iotconnect/.selfsigned/CA.pem

Then I copied my existing Node-RED flow from the previous posts, and replaced the Unique ID in the injection and IoTConnec nodes with the unique ID of our device here:

If you want to see the Thumbprint later and didn't store it: no worries. You can retrieve it from the certificate:

openssl x509 -fingerprint -in client.pem

Refer to this post for the correct ACK handling.

Deploy and enjoy.

Refer to this post for the correct ACK handling.

The connection is successful when the IotConnec node shows "connected" under its icon.

Here's the result of sending a temperature.

This is a good step from the previous authentication. More to follow.