What is wrong with my configuration? AWS - IoT using MQTT - amazon-web-services

Question

I am following the developer guide for amazon web service IoT, but I have run into some beginner problems and I don't know what to do to solve them. I been sitting for two days. This is what has happened (I am using mac):
1st problem:
In this guide: http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html
I can see and edit my profile by calling "$ was configure" in the terminal. If I call "ls ~/.aws" I can see the config and the credentials folder. But if i call: "~/.aws/credentials" or "~/.aws/config", I get the following error: -bash: /Users/christopher/.aws/credentials: Permission denied.
If i search in finder no file names aws is found.
2nd Problem:
On the next page of the guide, at number 11. i can't get the dot go green cause I get an error when I press connect. The MQTT.fx tool says that it can't find the rootCA.pem file, in the Log. Like this:
2015-11-10 09:55:48,330 INFO --- ScriptsController : Clear console.
2015-11-10 09:55:48,332 INFO --- MqttFX ClientModel : MqttClient with ID fc47354d17e84b6c8507eb1accb61560 assigned.
2015-11-10 09:55:48,340 ERROR --- MqttFX ClientModel : Error when connecting
java.io.FileNotFoundException: rootCA.pem (No such file or directory)
at java.io.FileInputStream.open0(Native Method) ~[?:1.8.0_60]
at java.io.FileInputStream.open(FileInputStream.java:195) ~[?:1.8.0_60]
at java.io.FileInputStream.<init>(FileInputStream.java:138) ~[?:1.8.0_60]
at java.io.FileInputStream.<init>(FileInputStream.java:93) ~[?:1.8.0_60]
at de.jensd.mqttfx.ssl.SSLFellow.loadX509CertificatePem(SSLFellow.java:173) ~[MQTT.fx-jfx.jar:?]
at de.jensd.mqttfx.ssl.SSLFellow.createSSLSocketFactory(SSLFellow.java:51) ~[MQTT.fx-jfx.jar:?]
at de.jensd.mqttfx.model.MqttFXClientModel.getMqttConnectOptions(MqttFXClientModel.java:713) ~[MQTT.fx-jfx.jar:?]
at de.jensd.mqttfx.model.MqttFXClientModel.connect(MqttFXClientModel.java:420) ~[MQTT.fx-jfx.jar:?]
at de.jensd.mqttfx.services.BrokerConnectService$1.call(BrokerConnectService.java:68) ~[MQTT.fx-jfx.jar:?]
at de.jensd.mqttfx.services.BrokerConnectService$1.call(BrokerConnectService.java:65) ~[MQTT.fx-jfx.jar:?]
at javafx.concurrent.Task$TaskCallable.call(Task.java:1423) ~[jfxrt.jar:?]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) ~[?:1.8.0_60]
at javafx.concurrent.Service.lambda$null$493(Service.java:725) ~[jfxrt.jar:?]
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_60]
at javafx.concurrent.Service.lambda$executeTask$494(Service.java:724) ~[jfxrt.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_60]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_60]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0_60]
2015-11-10 09:55:48,563 INFO --- ScriptsController : Clear console.
2015-11-10 09:55:48,563 ERROR --- BrokerConnectService : FileNotFoundException: rootCA.pem (No such file or directory)
When i click the "..." button next to the certificate I Notice two things.
1. The certificates here created in my user folder, not in the aws? config folder.
2. No rootCA.pem certificate have been created.
I followed this tutorial to sign my own rootCA.pem certificate: http://datacenteroverlords.com/2012/03/01/creating-your-own-ssl-certificate-authority/
Then in the MQTT.fx tool I press the "..." buttons again next to each certificate to manually select each certificate. The path to each one is displayed, like this: /Users/christopher/cert.pem
When I try to connect again i get the following error in the MQTT.fx tool:
2015-11-09 17:00:30,634 INFO --- ScriptsController : Clear console.
2015-11-09 17:00:30,635 ERROR --- BrokerConnectService : NullPointerException: null
2015-11-09 17:43:17,544 INFO --- BrokerConnectorController : onConnect
2015-11-09 17:43:17,592 INFO --- ScriptsController : Clear console.
2015-11-09 17:43:17,595 INFO --- MqttFX ClientModel : MqttClient with ID fc47354d17e84b6c8507eb1accb61560 assigned.
2015-11-09 17:43:17,661 ERROR --- MqttFX ClientModel : Error when connecting
java.lang.NullPointerException
at de.jensd.mqttfx.ssl.SSLFellow.loadPem(SSLFellow.java:221) ~[MQTT.fx-jfx.jar:?]
at de.jensd.mqttfx.ssl.SSLFellow.loadPrivateKeyPem(SSLFellow.java:184) ~[MQTT.fx-jfx.jar:?]
at de.jensd.mqttfx.ssl.SSLFellow.createSSLSocketFactory(SSLFellow.java:55) ~[MQTT.fx-jfx.jar:?]
at de.jensd.mqttfx.model.MqttFXClientModel.getMqttConnectOptions(MqttFXClientModel.java:713) ~[MQTT.fx-jfx.jar:?]
at de.jensd.mqttfx.model.MqttFXClientModel.connect(MqttFXClientModel.java:420) ~[MQTT.fx-jfx.jar:?]
at de.jensd.mqttfx.services.BrokerConnectService$1.call(BrokerConnectService.java:68) ~[MQTT.fx-jfx.jar:?]
at de.jensd.mqttfx.services.BrokerConnectService$1.call(BrokerConnectService.java:65) ~[MQTT.fx-jfx.jar:?]
at javafx.concurrent.Task$TaskCallable.call(Task.java:1423) ~[jfxrt.jar:?]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) ~[?:1.8.0_60]
at javafx.concurrent.Service.lambda$null$493(Service.java:725) ~[jfxrt.jar:?]
at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_60]
at javafx.concurrent.Service.lambda$executeTask$494(Service.java:724) ~[jfxrt.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_60]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_60]
at java.lang.Thread.run(Thread.java:745) [?:1.8.0_60]
2015-11-09 17:43:18,472 INFO --- ScriptsController : Clear console.
2015-11-09 17:43:18,473 ERROR --- BrokerConnectService : NullPointerException: null
I can see on the aws IoT site (the console?) that the certificate, the policy and the lightbulb are all connected just like in the tutorial. But the rest is a mystery.
I would be so happy for all help I can get. Thank you!

Answer 1

You have to sign your own CA when you use your own domain name. Location of the original root certificate can be found at http://docs.aws.amazon.com/iot/latest/developerguide/verify-pub-sub.html

Answer 2

The root CA certificate is not created for you, rather it is linked somewhere in the AWS IoT documentation and is the same for all.
See first parapgraph here:
http://docs.aws.amazon.com/iot/latest/developerguide/verify-pub-sub.html
The is the root CA:
https://www.symantec.com/content/en/us/enterprise/verisign/roots/VeriSign-Class%203-Public-Primary-Certification-Authority-G5.pem