SSL Verification failed while sending data via MQTT to x509 authenticated device in azure iot-hub

Question

I am trying to send sensor data to the X509 ca signed device created in my iot-hub verified using the certificates generated following the below link:

https://github.com/Azure/azure-iot-sdk-c/blob/master/tools/CACertificates/CACertificateOverview.md

I have attached the created root certificate, device certificate and device key while sending the data as in the following code:

from paho.mqtt import client as mqtt
import ssl

path_to_root_cert = "<local path to the generated testonly-rootca.pem>"
device_cert = "<local path to the generated newdevice-cert.pem>"
device_key = "<local path to the generated newdevice-key.pem>

HubName = "iothub.azure-devices.net"
devicename = "device001"

def on_connect(client, userdata, flags, rc):
print ("Connected with result code: " + str(rc))
client.subscribe("devices/" + devicename + "/messages/devicebound/#")

def on_disconnect(client, userdata, rc):
print ("Disconnected with result code: " + str(rc))

def on_message(client, userdata, msg):
print (msg.topic+" "+str(msg.payload))

client.publish("devices/" + devicename + "/messages/events/", "{id=1}",qos=1)

def on_publish(client, userdata, mid):
print ("Sent message")

client = mqtt.Client(client_id=devicename, protocol=mqtt.MQTTv311)
client.on_connect = on_connect

client.on_disconnect = on_disconnect
client.on_message = on_message
client.on_publish = on_publish
client.username_pw_set(username=HubName + "/" + devicename, password=None)
client.tls_insecure_set(False)

client.tls_set(ca_certs=path_to_root_cert, certfile=device_cert, keyfile=device_key, cert_reqs=ssl.CERT_REQUIRED, tls_version=ssl.PROTOCOL_TLSv1_2, ciphers=None)
client.connect(HubName, port=8883)
client.publish("devices/" + devicename + "/messages/events/", "{id=MQTT Test}", qos=1)
client.loop_forever()

I am getting the output as:

SSL_Verification_failed

I am using Paho to connect directly to azure iothub without using the azure-iothub-sdk.

Answer 1

Change "the created root certificate" to DigiCert Baltimore Root Certificate as the document points out:

In order to establish a TLS connection, you may need to download and reference the DigiCert Baltimore Root Certificate. This certificate is the one that Azure uses to secure the connection. You can find this certificate in the Azure-iot-sdk-c repository. More information about these certificates can be found on Digicert's website.

For code sample you can reference "Sample code for x509 authenticated device" part in this reply.