Cfrgtkky

I created thing on AWS core. Then downloaded cert, private key and rootCa certificate too. My main goal is to publish and subscribe to AWS shadow so that I can automate my home lighting system.
I tried to connect to aws iot using paho mqtt java client code, using following code.

    package test.pub;



    import java.io.BufferedInputStream;

    import java.io.FileInputStream;

    import java.io.FileReader;

    import java.security.KeyPair;

    import java.security.KeyStore;

    import java.security.Security;

    import java.security.cert.CertificateFactory;

    import java.security.cert.X509Certificate;



    import javax.net.ssl.KeyManagerFactory;

    import javax.net.ssl.SSLContext;

    import javax.net.ssl.SSLSocketFactory;

    import javax.net.ssl.TrustManagerFactory;



    import org.bouncycastle.jce.provider.BouncyCastleProvider;

    import org.bouncycastle.openssl.PEMDecryptorProvider;

    import org.bouncycastle.openssl.PEMEncryptedKeyPair;

    import org.bouncycastle.openssl.PEMKeyPair;

    import org.bouncycastle.openssl.PEMParser;

    import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;

    import org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder;

    import org.eclipse.paho.client.mqttv3.MqttClient;

    import org.eclipse.paho.client.mqttv3.MqttConnectOptions;

    import org.eclipse.paho.client.mqttv3.MqttException;



    public class App {



        public static void main(String args) {



            String serverUrl = "ssl://xxxxxxxx.iot.us-east- 

       1.amazonaws.com:8883";

            String caFilePath = "ca1.pem";

            String clientCrtFilePath = "thing.cert.pem";

            String clientKeyFilePath = "thing.private.key";



        MqttClient client;

        try {

            client = new MqttClient(serverUrl, MqttClient.generateClientId());

            MqttConnectOptions options = new MqttConnectOptions();



            options.setConnectionTimeout(60);

            options.setKeepAliveInterval(60);

            options.setMqttVersion(MqttConnectOptions.MQTT_VERSION_3_1);





            SSLSocketFactory socketFactory = getSocketFactory(caFilePath,

                    clientCrtFilePath, clientKeyFilePath, "");

            options.setSocketFactory(socketFactory);



            System.out.println("starting connect the server...");

            client.connect(options);

            System.out.println("connected!");

            Thread.sleep(1000);



            client.subscribe(

                    "test",

                    0);

            client.disconnect();

            System.out.println("disconnected!");





        } catch (MqttException e) {

            e.printStackTrace();

        } catch (Exception e) {

            e.printStackTrace();

        }



    }



    private static SSLSocketFactory getSocketFactory(final String caCrtFile,

            final String crtFile, final String keyFile, final String password)

            throws Exception {

        Security.addProvider(new BouncyCastleProvider());



        // load CA certificate

        X509Certificate caCert = null;



        FileInputStream fis = new FileInputStream(caCrtFile);

        BufferedInputStream bis = new BufferedInputStream(fis);

        CertificateFactory cf = CertificateFactory.getInstance("X.509");



        while (bis.available() > 0) {

            caCert = (X509Certificate) cf.generateCertificate(bis);

            // System.out.println(caCert.toString());

        }



        // load client certificate

        bis = new BufferedInputStream(new FileInputStream(crtFile));

        X509Certificate cert = null;

        while (bis.available() > 0) {

            cert = (X509Certificate) cf.generateCertificate(bis);

            // System.out.println(caCert.toString());

        }



        // load client private key

        PEMParser pemParser = new PEMParser(new FileReader(keyFile));

        Object object = pemParser.readObject();

        PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder()

                .build(password.toCharArray());

        JcaPEMKeyConverter converter = new JcaPEMKeyConverter()

                .setProvider("BC");

        KeyPair key;

        if (object instanceof PEMEncryptedKeyPair) {

            System.out.println("Encrypted key - we will use provided password");

            key = converter.getKeyPair(((PEMEncryptedKeyPair) object)

                    .decryptKeyPair(decProv));

        } else {

            System.out.println("Unencrypted key - no password needed");

            key = converter.getKeyPair((PEMKeyPair) object);

        }

        pemParser.close();



        // CA certificate is used to authenticate server

        KeyStore caKs = KeyStore.getInstance(KeyStore.getDefaultType());

        caKs.load(null, null);

        caKs.setCertificateEntry("ca-certificate", caCert);

        TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509");

        tmf.init(caKs);



        // client key and certificates are sent to server so it can authenticate

        // us

        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());

        ks.load(null, null);

        ks.setCertificateEntry("certificate", cert);

        ks.setKeyEntry("private-key", key.getPrivate(), password.toCharArray(),

                new java.security.cert.Certificate { cert });

        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory

                .getDefaultAlgorithm());

        kmf.init(ks, password.toCharArray());



        // finally, create SSL socket factory

        SSLContext context = SSLContext.getInstance("TLSv1.2");

        context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);



        return context.getSocketFactory();

    }



}

I am getting following console log and error

Unencrypted key - no password needed

starting connect the server...

Unable to connect to server (32103) - java.net.ConnectException: Connection timed out: connect

    at org.eclipse.paho.client.mqttv3.internal.TCPNetworkModule.start(TCPNetworkModule.java:79)

    at org.eclipse.paho.client.mqttv3.internal.SSLNetworkModule.start(SSLNetworkModule.java:82)

    at org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:590)

    at java.lang.Thread.run(Unknown Source)

Caused by: java.net.ConnectException: Connection timed out: connect

    at java.net.DualStackPlainSocketImpl.waitForConnect(Native Method)

    at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)

    at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)

    at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)

    at java.net.AbstractPlainSocketImpl.connect(Unknown Source)

    at java.net.PlainSocketImpl.connect(Unknown Source)

    at java.net.SocksSocketImpl.connect(Unknown Source)

    at java.net.Socket.connect(Unknown Source)

    at sun.security.ssl.SSLSocketImpl.connect(Unknown Source)

    at org.eclipse.paho.client.mqttv3.internal.TCPNetworkModule.start(TCPNetworkModule.java:70)

    ... 3 more

please help me to connect to aws IOT so that i can update shadow or atleast pub/sub to topics.