You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Below shows some common errors that can be experienced when trying to upload the device certificate.
192
-
193
-
#### Connection closed by peer {#common-errors-closed-by-peer}
194
-
195
-
If you're using a VPN it is possible that it is blocking the outgoing Cumulocity MQTT port that %%te%% uses, and sometimes it is not so obvious that the communication is being blocked by the VPN or firewall as tools like netcat (`nc`) might show that the port is available, however this does not show what responded to the request (so it could be the VPN responding and not Cumulocity).
196
-
197
-
Use the following command to check if the Cumulocity URL and MQTT Port are reachable from the device.
198
-
199
-
```sh
200
-
openssl s_client -connect "$(tedge config get c8y.mqtt)"< /dev/null
201
-
```
202
-
203
-
The output of the command should print the information about the certificates of the URL and port that you are trying to connect to. If you don't see any information about the certificates (e.g. the `Certificate chain` section is missing), then it is likely that the VPN's configuration or firewall is routing or blocking the communication, so try the same command with the VPN switched off.
204
-
205
-
Below shows an example of what is expected when communicating with the `eu-latest.cumulocity.com` Cumulocity instance, not that the `CN=*.eu-latest.cumulocity.com` matches the URL that was being checked against.
If you receive the following error, then you are most likely using the [custom domain feature](https://cumulocity.com/docs/enterprise-tenant/customization/#domain-name), and should see the [custom domain instructions](#custom-domain) to configure the correct HTTP and MQTT endpoints.
The 401 (Unauthorized) error means either the user and/or password is invalid forthe configured Cumulocity url that was setin the `tedge config set c8y.url <url>` command.
240
-
241
-
Check the following items to help you diagnose the root cause of the problem:
242
-
243
-
* Check the configured `c8y.url`. Copy/paste the url into a Web Browser to validate that it does open the intended Cumulocity tenant
244
-
* Check your username. The user/email is case-sensitive, so make sure the user matches your configured Cumulocity user
245
-
* Check your password. Use copy/paste to enter your password as this eliminates typos
246
-
* Check that you are not using a SSO user. SSO users are not permitted to use the REST API calls which the `tedge cert upload c8y`command is using. Please create a new Cumulocity user via the [Administration Page](https://cumulocity.com/docs/standard-tenant/managing-users/#to-add-a-user)
247
-
248
-
249
-
#### 403 - Forbidden {#common-errors-403}
250
-
251
-
The 403 (Forbidden) error means that your user/password is correct however you do not have sufficient permissions to add the %%te%%'s device certificate to the Cumulocity's [Trusted certificates](https://cumulocity.com/docs/device-integration/device-certificates/).
252
-
253
-
Your Cumulocity user **MUST** be assigned the **Tenant Manager** Global Role in order to add new trusted certificates to Cumulocity. Global roles can be assigned to users via the Cumulocity **Administration** application under Accounts → Users →`<your username>`→ Global Roles section. Below shows a screenshot of the **Tenant Manager** role that your user needs to be assigned to.
254
-
255
-
256
-
257
-
Alternatively, you can explicitly add one of the following permissions to your Cumulocity user: `ROLE_TENANT_MANAGEMENT_ADMIN` OR `ROLE_TENANT_ADMIN`, however this method requires you to be familiar with the [Cumulocity OpenAPI](https://cumulocity.com/api/core/#operation/postTrustedCertificateCollectionResource).
258
-
259
-
If you are still having trouble, please check out the official [Cumulocity documentation](https://cumulocity.com/docs/device-integration/device-certificates/#upload-your-ca-certificate).
260
-
261
-
262
-
#### Address is unreachable {#common-errors-unreachable}
263
-
264
-
If you are unable to reach Cumulocity, then it is likely that your device's network is not properly configured. This could be for many different reasons, however the following checks might help you spot where the mistake is:
265
-
266
-
* Can you ping a well known DNS server?
267
-
268
-
```
269
-
ping 8.8.8.8
270
-
```
271
-
272
-
The exact address is not that important, it used to see if a well established/reliable IP address is reachable from your device. You may need to adjust the IP address if your ISP (Internet Service Provider) blocks it for some reason.
273
-
274
-
* Can you reach another website?
275
-
276
-
Using Google is helpful here, as it is generally available, though you can also choose another popular/highly available website for your test.
277
-
278
-
```sh
279
-
curl google.com
280
-
```
281
-
282
-
* Check if the configured `c8y.url` is reachable by using curl
283
-
284
-
```sh title="bash"
285
-
curl "https://$(tedge config get c8y.url)/tenant/loginOptions"
286
-
```
287
-
288
-
If you are having problems resolving the `c8y.url` to an IP address, then it might be worthwhile considering manually adding a nameserver to the DNS configuration file as shown below:
289
-
290
-
```sh title="file: /etc/resolv.conf"
291
-
nameserver 8.8.8.8
292
-
```
293
-
294
193
## Connect the device
295
194
296
195
Now, you are ready to run `tedge connect c8y`.
@@ -414,6 +313,112 @@ Device Management → Devices → All devices → `device_id` → Me
414
313
415
314
You should observe a "temperature measurement" graph with the new data point.
416
315
316
+
## Common errors {#common-errors}
317
+
318
+
Below shows some common errors that can be experienced when trying to upload the device certificate or connect to Cumulocity.
319
+
320
+
### Connection closed by peer {#common-errors-closed-by-peer}
321
+
322
+
If you're using a VPN it is possible that it is blocking the outgoing Cumulocity MQTT port that %%te%% uses, and sometimes it is not so obvious that the communication is being blocked by the VPN or firewall as tools like netcat (`nc`) might show that the port is available, however this does not show what responded to the request (so it could be the VPN responding and not Cumulocity).
323
+
324
+
Use the following command to check if the Cumulocity URL and MQTT Port are reachable from the device.
325
+
326
+
```sh
327
+
openssl s_client -connect "$(tedge config get c8y.mqtt)"< /dev/null
328
+
```
329
+
330
+
The output of the command should print the information about the certificates of the URL and port that you are trying to connect to. If you don't see any information about the certificates (e.g. the `Certificate chain` section is missing), then it is likely that the VPN's configuration or firewall is routing or blocking the communication, so try the same command with the VPN switched off.
331
+
332
+
Below shows an example of what is expected when communicating with the `eu-latest.cumulocity.com` Cumulocity instance, not that the `CN=*.eu-latest.cumulocity.com` matches the URL that was being checked against.
If you receive the following error, then you are most likely using the [custom domain feature](https://cumulocity.com/docs/enterprise-tenant/customization/#domain-name), and should see the [custom domain instructions](#custom-domain) to configure the correct HTTP and MQTT endpoints.
The 401 (Unauthorized) error means either the user and/or password is invalid forthe configured Cumulocity url that was setin the `tedge config set c8y.url <url>` command.
367
+
368
+
Check the following items to help you diagnose the root cause of the problem:
369
+
370
+
* Check the configured `c8y.url`. Copy/paste the url into a Web Browser to validate that it does open the intended Cumulocity tenant
371
+
* Check your username. The user/email is case-sensitive, so make sure the user matches your configured Cumulocity user
372
+
* Check your password. Use copy/paste to enter your password as this eliminates typos
373
+
* Check that you are not using a SSO user. SSO users are not permitted to use the REST API calls which the `tedge cert upload c8y`command is using. Please create a new Cumulocity user via the [Administration Page](https://cumulocity.com/docs/standard-tenant/managing-users/#to-add-a-user)
374
+
375
+
376
+
### 403 - Forbidden {#common-errors-403}
377
+
378
+
The 403 (Forbidden) error means that your user/password is correct however you do not have sufficient permissions to add the %%te%%'s device certificate to the Cumulocity's [Trusted certificates](https://cumulocity.com/docs/device-integration/device-certificates/).
379
+
380
+
Your Cumulocity user **MUST** be assigned the **Tenant Manager** Global Role in order to add new trusted certificates to Cumulocity. Global roles can be assigned to users via the Cumulocity **Administration** application under Accounts → Users →`<your username>`→ Global Roles section. Below shows a screenshot of the **Tenant Manager** role that your user needs to be assigned to.
381
+
382
+
383
+
384
+
Alternatively, you can explicitly add one of the following permissions to your Cumulocity user: `ROLE_TENANT_MANAGEMENT_ADMIN` OR `ROLE_TENANT_ADMIN`, however this method requires you to be familiar with the [Cumulocity OpenAPI](https://cumulocity.com/api/core/#operation/postTrustedCertificateCollectionResource).
385
+
386
+
If you are still having trouble, please check out the official [Cumulocity documentation](https://cumulocity.com/docs/device-integration/device-certificates/#upload-your-ca-certificate).
387
+
388
+
389
+
### Address is unreachable {#common-errors-unreachable}
390
+
391
+
If you are unable to reach Cumulocity, then it is likely that your device's network is not properly configured. This could be for many different reasons, however the following checks might help you spot where the mistake is:
392
+
393
+
* Can you ping a well known DNS server?
394
+
395
+
```
396
+
ping 8.8.8.8
397
+
```
398
+
399
+
The exact address is not that important, it used to see if a well established/reliable IP address is reachable from your device. You may need to adjust the IP address if your ISP (Internet Service Provider) blocks it for some reason.
400
+
401
+
* Can you reach another website?
402
+
403
+
Using Google is helpful here, as it is generally available, though you can also choose another popular/highly available website for your test.
404
+
405
+
```sh
406
+
curl google.com
407
+
```
408
+
409
+
* Check if the configured `c8y.url` is reachable by using curl
410
+
411
+
```sh title="bash"
412
+
curl "https://$(tedge config get c8y.url)/tenant/loginOptions"
413
+
```
414
+
415
+
If you are having problems resolving the `c8y.url` to an IP address, then it might be worthwhile considering manually adding a nameserver to the DNS configuration file as shown below:
0 commit comments