azure iothub create-device-identity样例报错： unable to find valid certification path

llcong

　　https://docs.microsoft.com/zh-cn/azure/iot-hub/iot-hub-java-java-getstarted
　　在IDEA中执行上述的代码，会出现下面的报错信息：



Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1513)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1441)
at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:338)
at com.microsoft.azure.iot.service.transport.http.HttpConnection.getResponseStatus(HttpConnection.java:236)
at com.microsoft.azure.iot.service.transport.http.HttpRequest.send(HttpRequest.java:76)
at com.microsoft.azure.iot.service.sdk.RegistryManager.addDevice(RegistryManager.java:108)
at xxxx.azure.CreateDevIdentity.main(CreateDevIdentity.java:24)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at com.intellij.rt.execution.application.AppMain.main(AppMain.java:147)

　　通过IE访问接口的网址：https://xxx.azure-devices.cn/devices/xxdevId?api-version=2016-02-03
　　将网站的证书导出为CER文件
　　然后通过java的keytool导入证书（如果是windows平台，需要以管理员身份打开CMD来执行命令）



keytool -import -file E:\azure-devices.cn.cer -keystore "C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\cacerts" -alias azure-devices.cn

　　重新运行程序即可
　　另外：CER文件也可以通过linux下的openssl导出



openssl s_client -connect farm.azure-devices.cn:443 </dev/null 2>/dev/null | openssl x509 -outform DER > azure-devices.cer


iothub-explorer使用碰到的HTTPS的问题


iothub-explorer login "HostName=<my-hub>.azure-devices.net;SharedAccessKeyName=<my-policy>;SharedAccessKey=<my-policy-key>"
iothub-explorer create new-device --connection-string
　　iothub-explorer执行create命令时，会出现
　　Error: CERT_UNTRUSTED
　　可以在执行命令前设置下面的参数，绕过HTTPS校验



export NODE_TLS_REJECT_UNAUTHORIZED=0

　　参考：
　　http://stackoverflow.com/questions/10888610/ignore-invalid-self-signed-ssl-certificate-in-node-js-with-https-request
　　3.18补充，将Ubuntu的nodejs切换为4.x版本，可以避免上述问题



sudo apt-get remove nodejs ^node-* nodejs-*
sudo apt-get autoremove
sudo apt-get clean
curl -sL https://deb.nodesource.com/setup_4.x | sudo -E bash -
sudo apt-get install nodejs
curl https://raw.githubusercontent.com/creationix/nvm/v0.13.1/install.sh | sh
　　http://stackoverflow.com/questions/23393707/how-to-update-npm