使用paho-mqtt连接AWS IoT并执行发布操作失败求助

Hey there, sorry to hear your code stopped working out of nowhere—let’s walk through the most common fixes for this kind of issue step by step:

1. Rule Out AWS Service Outages #

First, check if there’s a transient issue with AWS IoT Core in the us-east-2 region. Head to the AWS Service Health Dashboard for your region and confirm IoT Core is operating normally. These outages are rare, but it’s quick to eliminate as a cause.

2. Validate Your Certificates & Keys #

• Double-check that your deviceCert.crt, deviceCert.key, and iotRootCA.pem files haven’t been corrupted, deleted, or edited by accident. Even a single missing character in the private key will break the TLS handshake.
• Verify your device certificate isn’t expired or revoked. Go to the AWS IoT Console > Manage > Things > [Your Thing] > Certificates—check the status here. If it’s revoked, you’ll need to reactivate it or generate a new certificate pair.
• Ensure you’re using the correct root CA. AWS recommends the Amazon Root CA 1—confirm your local iotRootCA.pem matches the official content (no need for external links, just cross-reference the text).

3. Confirm IoT Thing Policy Permissions #

It’s possible the policy attached to your thing was modified accidentally. Make sure it explicitly allows iot:Connect and iot:Publish actions for your target topic(s). A minimal working policy looks like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "arn:aws:iot:us-east-2:YOUR_ACCOUNT_ID:client/${iot:Connection.Thing.ThingName}"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "arn:aws:iot:us-east-2:YOUR_ACCOUNT_ID:topic/your/topic/path/*"
    }
  ]
}

Replace YOUR_ACCOUNT_ID and the topic path with your actual values.

4. Fix MQTT Client Configuration Issues #

• Unique Client ID: AWS IoT blocks multiple connections using the same client ID. If a stale instance of your code is running in the background, kill it or generate a unique ID (e.g., client_id = "my-device-" + str(random.randint(1, 1000))).
• TLS & Port Settings: Ensure you’re using port 8883 (standard for MQTT over TLS) and configure the SSL context correctly:

client = mqtt.Client(client_id=client_id)
client.tls_set(
    root_ca,
    certfile=public_crt,
    keyfile=private_key,
    cert_reqs=ssl.CERT_REQUIRED,
    tls_version=ssl.PROTOCOL_TLSv1_2,
    ciphers=None
)

• Complete the on_publish Callback: Your code cuts off mid-definition—even a placeholder callback prevents unexpected behavior:

def on_publish(client, userdata, mid):
    print(f"Message published with ID: {mid}")

5. Add Debugging to Get Clearer Context #

Modify your code to capture error details, which will make troubleshooting way easier:

• Add an on_error callback to catch connection errors:

def on_error(client, userdata, err):
    print(f"Connection error occurred: {err}")

• Enable logger to see raw MQTT traffic:

client.enable_logger()

• Check the response_code in on_connect—common codes mean:
  • 0: Success
  • 5: Unauthorized (policy/cert issue)
  • 3: Invalid client ID

6. Test Network Connectivity #

Make sure your device can reach the AWS IoT endpoint on port 8883. Run this command in your terminal:

openssl s_client -connect XXXXXXXX.iot.us-east-2.amazonaws.com:8883 -CAfile ./certs/iotRootCA.pem

If this fails, you might have a firewall, proxy, or network ACL blocking the connection.

Try these steps one by one—most sudden failures boil down to a cert/policy change or stale client ID. Let me know if you track down the issue!

内容的提问来源于stack exchange，提问作者Dalton Cézane