AWS iot self signed certs script - aws-cli

Question

I am attempting to create an automated version fo this process https://aws.amazon.com/premiumsupport/knowledge-center/iot-self-signed-certificates/
But i am running into some issues. I keep getting an error when I attempt to use the iot registration code for the CN field of the command
openssl req -new -key verificationCert.key -out verificationCert.csr -subj "/CN=$CN"
Im having trouble with appending the variable I have stored the registration code to into the CN portion.
When I do this manually it works.
--UPDATE--
openssl genrsa -out myRootCA.key 2048
openssl req -x509 -new -nodes -key myRootCA.key -sha256 -days 730 -subj "/C=US/ST=Massachusetts/L=Boston/O=Company/OU=USBDev/CN=CA STG CERT" -out myRootCA.pem
CN=$(aws iot get-registration-code | jq --raw-output .registrationCode)
openssl genrsa -out privateKeyCert.key 2048
openssl req -new -key privateKeyCert.key -subj "/CN=$CN" -out privateKeyCert.csr
openssl x509 -req -in privateKeyCert.csr -CA myRootCA.pem -CAkey myRootCA.key -CAcreateserial -out privateKeyCert.pem -days 730 -sha256
aws iot register-ca-certificate --ca-certificate file://myRootCA.pem --verification-cert file://privateKeyCert.pem

Answer 1

Step 1 : Generate the CA key and certificate
openssl genrsa -out cacert.key 2048
openssl req -x509 -new -nodes -key cacert.key -sha256 -days 365 -subj "C=US/ST=Massachusetts/L=Boston/O=Zoom Tel/OU=USBSensor iot/CN=CA STG CERT" -out cacert.pem
Step 2 : Getting registration code to put as the CN in a CSR
aws iot get-registration-code
{
"registrationCode": "xxxxxxx"
}
You can capture the registration code in a shell variable like this :
CN=$(aws iot get-registration-code | jq --raw-output .registrationCode)
Step 3 : Create the CA certificate (using the registration code)
Notice you only need to provide a CN here. nothing else.
openssl genrsa -out privateKeyVerification.key 2048
openssl req -new -key privateKeyVerification.key -subj "/CN=$CN" -out privateKeyVerification.csr
openssl x509 -req -in privateKeyVerification.csr -CA cacert.pem -CAkey cacert.key -CAcreateserial -out privateKeyVerification.crt -days 365 -sha256