azure iothub create-device-identity样例报错： unable to find valid certification path ，及iothub-explorer Error: CERT

azure iothub create-device-identity样例报错： unable to find valid certification path ，及iothub-explorer Error: CERT_UNTRUSTED

https://docs.microsoft.com/zh-cn/azure/iot-hub/iot-hub-java-java-getstarted

在IDEA中执行上述的代码，会出现下面的报错信息：

Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
	at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
	at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
	at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
	at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
	at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
	at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
	at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
	at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
	at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
	at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
	at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
	at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1513)
	at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1441)
	at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
	at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:338)
	at com.microsoft.azure.iot.service.transport.http.HttpConnection.getResponseStatus(HttpConnection.java:236)
	at com.microsoft.azure.iot.service.transport.http.HttpRequest.send(HttpRequest.java:76)
	at com.microsoft.azure.iot.service.sdk.RegistryManager.addDevice(RegistryManager.java:108)
	at xxxx.azure.CreateDevIdentity.main(CreateDevIdentity.java:24)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:497)
	at com.intellij.rt.execution.application.AppMain.main(AppMain.java:147)

通过IE访问接口的网址：https://xxx.azure-devices.cn/devices/xxdevId?api-version=2016-02-03

将网站的证书导出为CER文件

然后通过java的keytool导入证书（如果是windows平台，需要以管理员身份打开CMD来执行命令）

keytool -import -file E:azure-devices.cn.cer -keystore "C:Program FilesJavajdk1.8.0_66jrelibsecuritycacerts" -alias azure-devices.cn

重新运行程序即可

另外：CER文件也可以通过linux下的openssl导出

openssl s_client -connect farm.azure-devices.cn:443 </dev/null 2>/dev/null | openssl x509 -outform DER > azure-devices.cer

iothub-explorer使用碰到的HTTPS的问题

iothub-explorer login "HostName=<my-hub>.azure-devices.net;SharedAccessKeyName=<my-policy>;SharedAccessKey=<my-policy-key>"

iothub-explorer create new-device --connection-string

iothub-explorer执行create命令时，会出现

Error: CERT_UNTRUSTED

可以在执行命令前设置下面的参数，绕过HTTPS校验

export NODE_TLS_REJECT_UNAUTHORIZED=0

参考：

http://stackoverflow.com/questions/10888610/ignore-invalid-self-signed-ssl-certificate-in-node-js-with-https-request

3.18补充，将Ubuntu的nodejs切换为4.x版本，可以避免上述问题

sudo apt-get remove nodejs ^node-* nodejs-*
sudo apt-get autoremove
sudo apt-get clean
curl -sL https://deb.nodesource.com/setup_4.x | sudo -E bash -
sudo apt-get install nodejs

curl https://raw.githubusercontent.com/creationix/nvm/v0.13.1/install.sh | sh

http://stackoverflow.com/questions/23393707/how-to-update-npm