Greengrass certificates with and without the IP detector

With the IP detector (emphasis added):

Without IP detector, openssl s_client actually fails:

$ echo | openssl s_client -showcerts -connect 127.0.0.1:8883 2>/dev/null | openssl x509 -inform pem -noout -text
unable to load certificate
140682443964864:error:0909006C:PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: TRUSTED CERTIFICATE

This is because Greengrass isn't even listening on port 8883 as we can see by using netstat:

$ netstat -an | grep LISTEN | grep tcp
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp        0      0 127.0.0.1:8000          0.0.0.0:*               LISTEN
tcp6       0      0 :::22                   :::*                    LISTEN

If this happens your Greengrass group may not have the IP detector enabled (set to manual endpoint configuration), or the IP detector may be failing (too many IPs). Try setting Local connection detection to Automatically detect and override connection information in the group configuration and then do a redeployment. After the redeployment finishes the IP should be updated.