Azure IoT Edge Transparent Gateway

I tried Azure IoT Edge Transparent Gateway and share some of pitfalls. Below is the system configuration for this case.

Prerequiste
The prerequisite for Azure IoT Edge Transparent Gateway is to run through this tutorial to deploy Azure IoT Edge Runtime to your device. I used Raspberry Pi, and then referred to ARM32v7/armhf instruction.
https://docs.microsoft.com/en-us/azure/iot-edge/how-to-install-iot-edge-linux-arm

It is successful when you see edgeHub and edgeAgent are running on Raspberry Pi.

1. The gateway device settings (Raspberry Pi)
Then go through this instruction.
https://docs.microsoft.com/en-us/azure/iot-edge/how-to-create-transparent-gateway-linux
1.1
Choose a certain directory you want to work on, and download this to create your own X509 certificate at Raspberry Pi.
``` git clone https://github.com/Azure/azure-iot-sdk-c.git ```
1.2
Create CERTDIR directory somewhere and copy all necessary files from the directory you downloaded from github, and make certGen.sh executable.
``` cp azure-iot-sdk-c/tools/CACertificates/*.cnf . cp azure-iot-sdk-c/tools/CACertificates/certGen.sh . chmod 700 certGen.sh ```
1.3
Create owner CA certificate and intermediate certificate by command below.
``` ./certGen.sh create_root_and_intermediate ```
1.4
Next step is very tricky. The instruction mentions "DO NOT use a name that is the same as the gateway's DNS host name", but I did not get what this means. After having many trials, I used Raspberry Pi's local IP address as the gateway name here. The IP address should be fixed in this way. This does not look good, but I would discuss this later.
``` ./certGen.sh create_edge_device_certificate 192.168.100.103 ```
1.5
Then, create a certificate chain integrating certificates you prepared above. "azure-iot-test-only.root.ca.cert.pem" is generated.
cat ./certs/new-edge-device.cert.pem ./certs/azure-iot-test-only.intermediate.cert.pem ./certs/azure-iot-test-only.root.ca.cert.pem > ./certs/new-edge-device-full-chain.cert.pem

Open the yaml file
``` sudo vim /etc/iotedge/config.yaml ```
Change certificates and hostname
``` certificates: device_ca_cert: "/home/pi/iotedge/git/CERTDIR/certs/new-edge-device-full-chain.cert.pem" device_ca_pk: "/home/pi/iotedge/git/CERTDIR/private/new-edge-device.key.pem" trusted_ca_certs: "/home/pi/iotedge/git/CERTDIR/certs/azure-iot-test-only.root.ca.cert.pem" ```
``` hostname: "192.168.100.103" ```
2. The downstream device settings (Windows 10 Surface)
2.1
Next step is to install certificate to the downstream device, which is Windows 10 Surface Book in this case. All above so far is done on Raspberry Pi, but here you work on Surface Book with Windows 10.
Copy "azure-iot-test-only.root.ca.cert.pem" from Raspberry Pi to Surface. I just copied the text like below from Bash windows connected to Raspberry Pi through SSH, and paste to a newly created text file and change the name and extension to "azure-iot-test-only.root.ca.cert.pem".
``` -----BEGIN CERTIFICATE----- abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg abcdefgabcdefgabcdefgabcdefgababcdefabcdefgabcdefgabcdefgabcdefg -----END CERTIFICATE----- ```
2.2
1. Navigate to "Manage Computer Certificates" application
2. Right click "Certificates - Local Computer > Trusted Root Certification Authorities > Certificates"
3. All Tasks > Import
4. Go through with the instruction and choose the file "azure-iot-test-only.root.ca.cert.pem" in the Windows 10 local folder
5. You can see the message "Successfully imported"
2.3
For the downstream device sending messages to the gateway, I use Visual Studio 2017 and .NET Core and Azure IoT Device SDK. You can use this sample below just for a connection trial. Put "Hostname" from IoT Hub, "DeviceId" from IoT Edge, "SharedAccessKey" from IoT Edge > Device Details > Primary Key, GateWayHostName from the gateway device name.
https://github.com/Azure-Samples/azure-iot-samples-csharp/blob/master/iot-hub/Quickstarts/simulated-device/SimulatedDevice.cs

``` HostName=koheikawata.azure-devices.net;DeviceId=koheikawata;SharedAccessKey=xxxxxx=;GatewayHostName=192.168.100.103 ```

Point 1 - hostname
The three names below should be the same. This time I used the current local IP address of Raspberry Pi "192.168.100.103"

Pattern 1
1) the Edge device CA certificate
Use the command below
``` ./certGen.sh create_edge_device_certificate 192.168.100.103 ```
2) hostname in config.yaml
``` hostname: "192.168.100.103" ```
3) connection string at Device SDK

``` private readonly static string s_connectionString = "HostName=koheikawata.azure-devices.net;DeviceId=koheikawata;SharedAccessKey=xxxxxx=;GatewayHostName=192.168.100.103" ```

You can use a hostname, for example, "raspberrypikoheikawata" instead of "192.168.100.103", but it should be the hostname which is a part of DNS, i.e. the downstream device has to be able to receive response from the Edge Gateway by a command like "ping raspberrypikoheikawata" in your network. In my case, I used a Wifi network where it is difficult to define a hostname on the Raspberry Pi, and then I added "192.168.100.103 raspberrypikoheikawata" to the "C:\Windows\System32\drivers\etc\hosts" to make the connection possible. This is not a practical way, though.

Pattern 2
1) the Edge device CA certificate
When creating with this command below
``` ./certGen.sh create_edge_device_certificate raspberrypikoheikawata ```
2) hostname in config.yaml
``` hostname: "raspberrypikoheikawata" ```
3) connection string at Device SDK

``` private readonly static string s_connectionString = "HostName=koheikawata.azure-devices.net;DeviceId=koheikawata;SharedAccessKey=xxxxxx=;GatewayHostName=raspberrypikoheikawata" ```

4) hosts file (C:\Windows\System32\drivers\etc\hosts)
``` 192.168.100.103 raspberrypikoheikawata ```

Point 2 - Protocols

Now Azure IoT Edge Transparent Gateway does not support HTTP connection, but only MQTT and AMQP. According to the official documentation below, currently Edge Hub supports only MQTT and AMQP.
https://docs.microsoft.com/en-us/azure/iot-edge/iot-edge-runtime


Also, this page describes we cannot use HTTP and websocket for Azure IoT Edge Transparent Gateway because HTTP and websocket are not supported for X509-CA authentication.
https://github.com/Azure/azure-iot-sdk-csharp