Medical Internet of Things (MIoT), also known as smart healthcare or Medical 4.0, typically refers to intelligent devices such as medical equipment, wearable sensors, and remote monitoring instruments connected to healthcare applications. These devices are used to collect, transmit, exchange, and analyze health data, thereby improving the quality, efficiency, and safety of medical services. However, these medical data are often vulnerable to security threats during transmission. To safeguard secure communication and privacy preservation in MIoT, several certificateless aggregate signature (CLAS) schemes have been introduced. Nevertheless, most of these schemes depend on a centralized key generation center (KGC) and remain susceptible to coalition attacks, KGC compromise attacks, and distributed denial-of-service (DDoS) attacks. In this paper, we design a blockchain-based certificateless anonymous aggregate signature (CLAAS) scheme for MIOT and demonstrate that it can achieve complete decentralization of entities, thereby resisting KGC compromised attacks. This blockchain-based CLAAS scheme has strong robustness, which can resist DDoS attacks and coalition attacks launched by several medical sensor nodes. The proposed scheme can safeguard provable security in the random oracle model and no longer rely on secure channels to obtain the partial private key. Furthermore, performance evaluation reveals that the decentralized CLAAS scheme outperforms existing schemes in terms of both communication and computational overhead, highlighting its strong practical applicability in MIoT systems.