AWS IoT - 通过.Net,REST和证书访问阴影

为了学习AWS IoT,我创建了一些"东西"+一个策略,我甚至可以使用IoT CLI来列出事物或列表策略.我甚至可以通过CLI使用update-thing命令通过CLI 更新阴影.但是一旦我尝试通过REST GET/POST请求(通过.Net程序或直接访问https://XXXXXXXXXXXXX.iot.us-west-2.amazonaws.com/things/mything/shadow)访问Shadow ,我收到一个

"缺少身份验证令牌"

.所以我开始使用证书.这是我的代码的一部分:

string Certificate = "xxxxxxxxx-certificate.crt"; // downloaded from my thing
X509Certificate cert = new X509Certificate(Certificate);
WebRequestHandler handler = new WebRequestHandler();
handler.ClientCertificates.Add(cert);
HttpClient client = new HttpClient(handler);
// url = @"https://xxxxxxxxxxxxx.iot.us-west-2.amazonaws.com/things//shadow";
HttpResponseMessage webResponse = client.GetAsync(url, HttpCompletionOption.ResponseContentRead).Result;

结果是:

StatusCode:403,ReasonPhrase:'Forbidden',版本:1.1,内容:System.Net.Http.StreamContent,标题:
{
x-amzn-RequestId:25f3c1dc-9ddd-4787-a4cf-cb79dc96748b
connection:Keep-Alive
x-amzn -ErrorType:ForbiddenException:
Date:Tue,15 Dec 2015 08:53:56 GMT
Content-Length:91
Content-Type:application/json
}

任何帮助？