ESP8266（NodeMCU）接入AWS IoT时遇invalid key错误求助

运行MicroPython的NodeMCU（ESP8266）连接AWS IoT时抛出ValueError: invalid key错误，已尝试将AWS下载的密钥转换为DER格式，但问题依旧。

错误日志 #

start connecting
Connected:  True
Key and Certificate files Loaded
Connecting to AWS IoT...
Traceback (most recent call last):
    File "<stdin>", line 49, in <module>
    File "<stdin>", line 45, in mqtt_connect
    File "umqtt/simple.py", line 74, in connect
    File "ssl.py", line 1, in wrap_socket
    File "ssl.py", line 1, in wrap_socket
ValueError: invalid key

运行代码 #

import time
import network
import urequests
SSID = "SHEKHAR"
PASSWORD = "shekhar123"

print("start connecting")
    
wlan = network.WLAN(network.STA_IF)
wlan.active(True)
wlan.connect(SSID, PASSWORD)

while wlan.isconnected() == False:
    pass

print("Connected: ", wlan.isconnected())


import sys
import machine
from umqtt.simple import MQTTClient

clientId = 'nodemcu'
AWS_ENDPOINT = 'a2xf5sr3dys5uo-ats.iot.us-east-1.amazonaws.com'
PORT = 8883

certfile = '/certificate.crt.der'
with open(certfile, 'rb') as f:
    cert = f.read()
f.close()

keyfile = '/private.key.der'
with open(keyfile, 'rb') as f:
    key = f.read()
f.close()

print("Key and Certificate files Loaded")

SSL_PARAMS = {'key': key, 'cert': cert, 'server_side': False}

# client = MQTTClient(clientId, AWS_ENDPOINT, port=PORT, keepalive=10000, ssl=True, ssl_params=SSL_PARAMS)
def mqtt_connect(client=clientId, endpoint=AWS_ENDPOINT, sslp=SSL_PARAMS):
    mqtt = MQTTClient(client_id=client, server=endpoint, port=8883, keepalive=1200, ssl=True, ssl_params=sslp)
    print("Connecting to AWS IoT...")
    mqtt.connect()
    print("Done")
    return mqtt

mqtt_connect()

1. 确保密钥转换格式正确 #

AWS下载的私钥默认是PEM格式，转换为DER时必须使用针对RSA私钥的命令，MicroPython不支持PKCS#8格式的密钥：

openssl rsa -in private.key -out private.key.der -outform DER

2. 验证转换后的文件有效性 #

用OpenSSL检查转换后的DER文件是否完整：

# 检查私钥
openssl rsa -in private.key.der -inform DER -text -noout
# 检查证书
openssl x509 -in certificate.crt.der -inform DER -text -noout

如果命令报错，说明转换过程出错，重新生成DER文件。

3. 二进制模式传输文件 #

传输DER文件到NodeMCU时必须用二进制模式，避免文本模式损坏文件内容。比如使用ampy工具时：

ampy --port /dev/ttyUSB0 put private.key.der --binary
ampy --port /dev/ttyUSB0 put certificate.crt.der --binary

4. 调整SSL参数格式 #

部分MicroPython版本要求key和cert以元组形式传入，修改SSL_PARAMS：

SSL_PARAMS = {
    'key': (key,),
    'cert': (cert,),
    'server_side': False
}

5. 更换MQTT客户端模块 #

umqtt.simple的SSL处理存在兼容性问题，换成umqtt.robust模块尝试：

# 替换导入语句
from umqtt.robust import MQTTClient

内容的提问来源于stack exchange，提问作者Shekhar