title: AWS IOT Just-in-Time Registration of Certificate in Android
body: <p>I am integrating the JITR by follwing this article.</p>
  
  <p><a href="https://aws.amazon.com/blogs/iot/just-in-time-registration-of-device-certificates-on-aws-iot/" rel="nofollow noreferrer">https://aws.amazon.com/blogs/iot/just-in-time-registration-of-device-certificates-on-aws-iot/</a></p>
  
  <p>I am done with all these steps and able to authenticate the certificate through command-line 'mosquitto_pub'.</p>
  
  <p>First time when I run 'mosquitto_pub' command it calls lambda function to authorize it and attach policy and second time it publish message to IOT successfully.</p>
  
  <p>Here is command that I am using.</p>
  
  <pre><code>mosquitto_pub --cafile ../root.cert --cert hassanAndCACert.crt --key hassan.key -h &lt;###&gt;.iot.us-east-1.amazonaws.com
  -p 8883 -q 1 -t  topic5 -i  123456789 --tls-version tlsv1.2 -m '{"hello":"3"}' -d
  </code></pre>
  
  <p>But when I try to authenticate this in android SDK I am getting 'handshake' fail error. Here is exception that I am getting.</p>
  
  <blockquote>
    <p>MqttException (0) - javax.net.ssl.SSLHandshakeException: Handshake
    failedat
    org.eclipse.paho.client.mqttv3.internal.ExceptionHelper.createMqttException(ExceptionHelper.java:38)at
    org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:664)at
    java.lang.Thread.run(Thread.java:818)Caused by:
    javax.net.ssl.SSLHandshakeException: Handshake failedat
    com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:441)at
    org.eclipse.paho.client.mqttv3.internal.SSLNetworkModule.start(SSLNetworkModule.java:93)at
    org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:650)
    ... 1 moreCaused by: javax.net.ssl.SSLProtocolException: SSL handshake
    terminated: ssl=0xb91e9b40: Failure in SSL library, usually a protocol
    errorerror:100c5416:SSL
    routines:ssl3_read_bytes:SSLV3_ALERT_CERTIFICATE_UNKNOWN
    (external/boringssl/src/ssl/s3_pkt.c:972 0xb9215530:0x00000001)at
    com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native
    Method)at
    com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:353)</p>
  </blockquote>
  
  <p>Interestingly  if device-certificate is already active and we try to publish message through android it get published successfully. The only problem is to authenticate the certificate at first call. If my code is faulty it should not send message against activated-certificates.</p>
  
  <p>The difference that I see between mosquitto call and the android-code is that mosquitto is making a single command to connect and publish the message, where as PAHO-MQTT in AWS SDK needs to connect first before publishing, and I get exception in 'connect'. I even did not get any logs in AWS logs.</p>