X509_check_private_key:key values mismatch error: DPS ,IOT hub

Question

I am not able to create Devices on IOT hub in node.js. I have replaced provisioning host with the Global Device Endpoint, idScope with the ID Scope of my DPS. I am using group enrollment with x.509 certificates, so i am using certificate's subject name as a value for registrationId.I have also linked my IoT hub to Device Provisioning Service.

var provisioningHost = "global.azure-devices-provisioning.net"; 
var idScope = "6n*******3"; //Replace id scope with the ID Scope
var **registrationId** = "Azure IoT CA TestOnly Root CA"; 
var deviceCert = {
  cert: fs.readFileSync("./IOTProj_cert.pem").toString(), 
  key: fs.readFileSync("./IOTProj_key.pem").toString()
};

I am executing azure-iot-sdk-node/provisioning/device/samples/register_x509.js file but getting below error:

PS D:\TestNode\azure-iot-sdk-node-master\provisioning\device\samples> node .\register_x509.js
_tls_common.js:149

Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch at Object.createSecureContext (_tls_common.js:149:17) at Object.connect (_tls_wrap.js:1582:48) at Object.buildBuilder (D:\TestNode\azure-iot-sdk-node-master\provisioning\device\samples\node_modules\mqtt\lib\connect\tls.js:17:20) at MqttClient.wrapper [as streamBuilder] (D:\TestNode\azure-iot-sdk-node-master\provisioning\device\samples\node_modules\mqtt\lib\connect\index.js:153:36) at MqttClient._setupStream (D:\TestNode\azure-iot-sdk-node-master\provisioning\device\samples\node_modules\mqtt\lib\client.js:298:22)
library: 'x509 certificate routines', function: 'X509_check_private_key', reason: 'key values mismatch', code: 'ERR_OSSL_X509_KEY_VALUES_MISMATCH' }

I am following below links

Creating test certificates: Managing test CA certificates for samples and tutorials

create-simulated-device-x509-nodeJS#Simulate the device

IoT Hub Device Provisioning Service device concepts#Registration ID

Samples for the Azure IoT Device Provisioning Device SDK for Node.js

EDIT- I want to use group enrollment .

Steve Busby - MSFT Steve Busby - MSFT · Accepted Answer · 2020-08-31T15:40:23

From the code above, it looks like you are using ""Azure IoT CA TestOnly Root CA" as the registrationId? the registrationId should be the cn/subject of the device certificate itself (whatever you passed into './certGen.sh create_device_certificate' command), not the root certificate CA. What kind of certificate is "IOTProj_cert.pem"? is that the device's certificate? or the root CA certificate?

X509_check_private_key:key values mismatch error: DPS ,IOT hub

1 Answers