Sending messages to Azure IoT Hub from within Windows docker container

Question

I am pretty new to Docker and I have to build a container that can run a Python script that sends messages periodically to an Azure IoT Hub using the rows of a CSV file. I have already built this container using Linux, but due to limitations of my resources, I must rebuild the image using a Windows container. This is the setup of my Dockerfile that I am attempting to use:

FROM mcr.microsoft.com/windows/servercore:1809

# Install pip requirements
ADD requirements.txt .
RUN python -m pip install -r requirements.txt

WORKDIR /app 
ADD SimulatedDeviceFitbit.py .

WORKDIR /app 
COPY sensor_original2.csv .

CMD ["python", "SimulatedDeviceFitbit.py"]

The only package added using Pip is the azure-iot-device library. The CSV is used to read the data that will be sent as a message and the script handles the sending of the message. Whenever I run the image, the error:

azure.iot.device.common.transport_exceptions.TlsExchangeAuthError: TlsExchangeAuthError(None) caused by SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1123)')

The connection made to the IoT hub in the script looks like this:

client = IoTHubDeviceClient.create_from_connection_string(CONNECTION_STRING)

I checked my network devices through Docker and did not see any issues but obviously I am missing something. I have no experience networking in a container and would appreciate any guidance.

asergaz asergaz · Accepted Answer · 2020-09-02T11:37:46

I believe your container image is missing Baltimore Root CA.

As you are using a Windows Server Core Container Image you will probably need to enable some WindowsFeatures in order to import the certificate to the certificate store using certutil.

Your DockerFile should include something like this:

# Copy PFX file (located on HOST on C:\test) to container and install
ADD "c:\test\BaltimoreRootCA.pfx" "c:\test\BaltimoreRootCA.pfx"
RUN certutil -importpfx "c:\test\BaltimoreRootCA.pfx"

You can export Baltimore Root CA from a windows machine or copy it from Azure IoT SDK C Github Repo

As a reference check also this repo with some steps on how to enable windows features and import certificates: https://github.com/fabioharams/container
And alternative ways to import certs on this related SO thread: Docker SSL Cert for windows

Sending messages to Azure IoT Hub from within Windows docker container

1 Answers