Settting IoT Hub to TLS 1.2 results in an MQTT not authorized issue

Question

Settting IoT Hub to TLS 1.2 results in an MQTT not authorized issue

Eric Brunner 0

Hi,

After setting the IoT hub to TLS 1.2, my Azure IoT DevKit board doesn't connect anymore.

I narrowed the area in the code down where the issue happens when I configured IoT hub with TLS 1.2:

Firmware: https://github.com/eclipse-threadx/getting-started/tree/master/MXChip/AZ3166

Code Area:

https://github.com/eclipse-threadx/netxduo/blob/2973652d801e92615caa285ad9ee13db19a26cb9/addons/mqtt/nxd_mqtt_client.c#L4203

Method:

UINT _nxd_mqtt_client_connect(NXD_MQTT_CLIENT *client_ptr, NXD_ADDRESS *server_ip, UINT server_port, UINT keepalive, UINT clean_session, ULONG wait_option)

Call to:

/* Process CONNACK message. */

status _= *nxd_mqtt_process_connack*(client_ptr, packet_ptr, wait_option);

Returns:

Status: 65669 (NXD_MQTT_ERROR_NOT_AUTHORIZED 0x10085)

It seems the the whole Azure RTOS (eclipse-threadx) project is inactive since 3 years, Any help much appreciated 😊

VSawhney 880 Reputation points Microsoft External Staff Moderator

2025-08-12T11:01:30.01+00:00
Hello Eric Brunner,

Hey! It sounds like you're encountering an issue with your Azure IoT Hub connection after switching to TLS 1.2. The NXD_MQTT_ERROR_NOT_AUTHORIZED status suggests that there may be an issue with authorization, which is often linked to a problem with the SAS token, X.509 certificate, or the minimum TLS settings.

Here are a few steps you can try to troubleshoot the issue:

Verify SAS Token: Ensure that the SAS token your device is using is valid and not expired. The default lifespan is 60 minutes, so if the device was offline for a while, you might need to regenerate the token.

Check Device ID and Permissions: Make sure that the device ID you're using in your connection string matches a device registered in the IoT Hub and that it has the necessary permissions.

Firmware and Library Updates: Since you mentioned that you are using an inactive project, verify that you are using the latest available libraries for your code that support TLS 1.2. If feasible, consider switching to a more actively maintained library that supports Azure IoT features.

TLS Configuration: Double-check if your IoT Hub is configured to enforce TLS 1.2 correctly. You can do this in the Azure portal under your IoT Hub settings.

Root Certificates: Make sure that your device trusts the DigiCert Global Root G2 certificate, which Azure uses. If your device does not trust it, you will need to load this root CA.

Network Policies: Check if there are any IP filtering or connection policies in place that might be affecting your device’s ability to connect.

Clock Drift: Ensure that your device’s clock is synchronized with an NTP service. Significant clock drift can cause authentication issues due to incorrect timestamps in the SAS token.

If none of these steps resolve the issue, I would suggest checking Azure logs for more specific error codes or patterns related to your connection attempts.

Hope this helps!
Thank you!

Share via

Settting IoT Hub to TLS 1.2 results in an MQTT not authorized issue

Your answer