Сертификат JITP не создан с помощью mbedTLS ATECC608A (работает с moquitto_pub)

#amazon-web-services #aws-iot #mbedtls

Вопрос:

У меня следующая настройка:

ATECC608A
mbedTLS (протестирован с 2.16.6 и 2.16.9)
coreMQTT Цепочка сертификатов выглядит следующим образом: RootCA > SignerCA> DeviceCert. Я зарегистрировал как RootCA, так и SignerCA в качестве центров сертификации в консоли AWS IoT

Я настраиваю цепочку в mbedTLS следующим образом:

 /* Extract the device certificate and convert to mbedtls cert */
if (0 != atca_mbedtls_cert_add(amp;device_cert_chain, amp;g_cert_def_2_device))
{
    printf("Failed to parse device cert from devicen");
    goto exit;
}

/* Extract the signer certificate, convert, then attach to the chain */
if (0 != atca_mbedtls_cert_add(amp;device_cert_chain, amp;g_cert_def_1_signer))
{
    printf("Failed to parse signer cert from devicen");
    goto exit;
}

При подключении к моей ats-конечной точке с помощью этого стека рукопожатие TLS проходит успешно: отображаются сертификат устройства и signerCA, а AWS также представляет свою цепочку сертификатов. mbedTLS, похоже, доволен:

 ....[SNIP]
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:2898: <= parse server hello done
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3522: client state: 7
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2765: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5343: => write certificate
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: own certificate #1:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: cert. version     : 3
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: serial number     : 40:F7:D9:46:59:6E:2F:58:E6:87:04:4F:D5:6E:86:03
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issuer name       : O=CompanyName, CN=signer.companyname.com FFFF
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: subject name      : O=CompanyName, CN=pu0223528E47B3461DEE
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issued  on        : 2021-01-14 21:00:00
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: expires on        : 3000-12-31 23:59:59
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: signed using      : ECDSA with SHA256
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: EC key size       : 256 bits
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: basic constraints : CA=false
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: key usage         : Digital Signature, Key Agreement
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(X)' (256 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  c7 1f a4 ea e7 ae 51 16 fb c3 0b ce 33 f1 7a af
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  f1 27 3a af a7 5d 76 76 74 58 e8 56 36 94 56 76
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(Y)' (255 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  5f a6 2e 21 53 a5 91 7d 95 f8 9e 0e f8 ce bd d9
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  c1 50 83 c2 7d 74 98 4b 66 b2 eb 9a b7 49 48 4c
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: own certificate #2:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: cert. version     : 3
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: serial number     : 4D:29:66:FF:B8:09:8D:39:0E:39:C8:3A:94:6E:EE:6A
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issuer name       : O=CompanyName, CN=root.companyname.com FFFF
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: subject name      : O=CompanyName, CN=signer.companyname.com FFFF
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issued  on        : 2020-11-09 17:55:11
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: expires on        : 2070-10-28 17:44:12
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: signed using      : ECDSA with SHA256
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: EC key size       : 256 bits
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: basic constraints : CA=true
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: key usage         : Digital Signature, Key Cert Sign, CRL Sign
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(X)' (256 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  cc 63 87 d3 bd 58 08 1e c7 55 02 be a8 e1 d7 a2
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  f9 7f 62 0a 39 c6 40 45 cf 1d 83 4a 53 5e 6a e3
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(Y)' (255 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  5b be ad 83 96 10 3c 0e 5b 0b 60 32 65 5d d3 3b
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  77 90 b2 a7 a8 cb 90 b7 49 3f 24 cd c6 6b 1f 38
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3192: => write handshake message
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3351: => write record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3428: output record: msgtype = 22, version = [3:3], msglen = 982
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: dumping 'output record sent to network' (987 bytes)

....[SNIP]
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4399: <= read record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6606: <= parse finished
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3522: client state: 14
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2765: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3633: handshake: done
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3522: client state: 15
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2765: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6350: => handshake wrapup
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6323: => handshake wrapup: final free
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6343: <= handshake wrapup: final free
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6405: <= handshake wrapup
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8108: <= handshake
 ok
TLS Session Established and a Socket is ready for an Application

Затем я использую созданный mbedtls_ssl_context для подключения coreMQTT. Из журнала coreMQTT может записывать данные в сокет, но AWS закрывает соединение.

 ...[SNIP]...
TLS Session Established and a Socket is ready for an Application
Initializing MQTT...ok
Connecting to the MQTT broker with params:
- identifier='testclient'
- username='?SDK=Fedoraamp;Version=33amp;Platform=PCamp;MQTTLib=core-mqtt@v1.1.0'
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8696: => write
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3351: => write record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1443: => encrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: dumping 'before encrypt: output payload' (85 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0000:  10 53 00 04 4d 51 54 54 04 82 00 3c 00 0a 74 65  .S..MQTT...<..te
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0010:  73 74 63 6c 69 65 6e 74 00 3b 3f 53 44 4b 3d 46  stclient.;?SDK=F
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0020:  65 64 6f 72 61 26 56 65 72 73 69 6f 6e 3d 33 33  edoraamp;Version=33
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0030:  26 50 6c 61 74 66 6f 72 6d 3d 50 43 26 4d 51 54  amp;Platform=PCamp;MQT
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0040:  54 4c 69 62 3d 63 6f 72 65 2d 6d 71 74 74 40 76  TLib=core-mqtt@v
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0050:  31 2e 31 2e 30                                   1.1.0
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1572: dumping 'additional data for AEAD' (13 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1572: 0000:  00 00 00 00 00 00 00 01 17 03 03 00 55           ............U
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1602: dumping 'IV used (internal)' (12 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1602: 0000:  91 d1 a1 52 00 00 00 00 00 00 00 01              ...R........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1604: dumping 'IV used (transmitted)' (8 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1604: 0000:  00 00 00 00 00 00 00 01                          ........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1614: before encrypt: msglen = 93, including 0 bytes of padding
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1641: dumping 'after encrypt: tag' (16 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1641: 0000:  db 24 89 b1 5f 7f e6 ff 78 dd c3 8b 34 99 79 1f  .$.._...x...4.y.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1779: <= encrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3428: output record: msgtype = 23, version = [3:3], msglen = 109
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: dumping 'output record sent to network' (114 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0000:  17 03 03 00 6d 00 00 00 00 00 00 00 01 ba 08 e9  ....m...........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0010:  fb f4 64 84 4e 6d 31 6e 89 3f 7b 74 e1 9a 0a af  ..d.Nm1n.?{t....
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0020:  82 33 4e 7b 13 23 de ba 55 19 41 24 6e 95 14 3c  .3N{.#..U.A$n..<
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0030:  2a 6e 02 67 6d 76 4d f8 32 a0 45 ca 12 a2 1a 31  *n.gmvM.2.E....1
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0040:  97 26 45 13 88 07 2c 18 13 ab 92 4b 2b 98 41 49  .amp;E...,....K .AI
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0050:  03 5a 4f a9 5d 95 33 2b 68 c9 16 ee 2a ad 59 0a  .ZO.].3 h...*.Y.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0060:  7a 52 db 24 89 b1 5f 7f e6 ff 78 dd c3 8b 34 99  zR.$.._...x...4.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0070:  79 1f                                            y.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2771: message length: 114, out_left: 114
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2777: ssl->f_send() returned 114 (-0xffffff8e)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2805: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3484: <= write record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8724: <= write
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8284: => read
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4325: => read record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2534: => fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2694: in_left: 0, nb_want: 5
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2718: in_left: 0, nb_want: 5
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2720: ssl->f_recv(_timeout)() returned 5 (-0xfffffffb)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2740: <= fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4061: dumping 'input record header' (5 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4061: 0000:  15 03 03 00 1a                                   .....
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4067: input record: msgtype = 21, version = [3:3], msglen = 26
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2534: => fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2694: in_left: 5, nb_want: 31
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2718: in_left: 5, nb_want: 31
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2720: ssl->f_recv(_timeout)() returned 26 (-0xffffffe6)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2740: <= fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4246: dumping 'input record from network' (31 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4246: 0000:  15 03 03 00 1a 00 00 00 00 00 00 00 01 33 90 3f  .............3.?
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4246: 0010:  df 0b 29 53 90 20 f1 90 14 82 84 99 e9 f6 db     ..)S. .........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1792: => decrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1879: dumping 'additional data for AEAD' (13 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1879: 0000:  00 00 00 00 00 00 00 01 15 03 03 00 02           .............
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1908: dumping 'IV used' (12 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1908: 0000:  3a e9 5a f2 00 00 00 00 00 00 00 01              :.Z.........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1909: dumping 'TAG used' (16 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1909: 0000:  3f df 0b 29 53 90 20 f1 90 14 82 84 99 e9 f6 db  ?..)S. .........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2374: <= decrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4273: dumping 'input payload after decrypt' (2 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4273: 0000:  01 00                                            ..
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5183: got an alert message, type: [1:0]
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5199: is a close notify message
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4383: mbedtls_ssl_handle_message_type() returned -30848 (-0x7880)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8349: mbedtls_ssl_read_record() returned -30848 (-0x7880)

I expect the first connection to fail. But in this case, the certificate does not appear in the AWS IoT console and subsequent connection attempts fail as well.

I double checked the signerCA stored and its policy. They seem fine. To ensure that this confg is correct, I manually created a certificate on my machine and signed it with my SignerCA.I then used that certificate with mosquitto_pub. The process works and my certificate appears in the AWS IoT console with the correct policy attached. Here’s a log of what I’m doing:

 $ openssl genpkey -out fakeDeviceCert.key -algorithm EC -pkeyopt ec_paramgen_curve:P-256
$ openssl req -new -key fakeDeviceCert.key -out fakeDeviceCert.csr
$ openssl x509 -req -in fakeDeviceCert.csr -CA ../certs/signer-FFFF.crt 
   -CAkey ../certs/signer-FFFF.key 
   -CAcreateserial 
  -out fakeDeviceCert.pem 
  -days 357335 
  -sha256
$ cat fakeDeviceCert.pem ../certs/signer-FFFF.crt > deviceCertAndCACert.crt
$ mosquitto_pub --cafile AmazonRootCA1.pem 
    --cert deviceCertAndCACertcrt --key fakeDeviceCert.key 
    -h <redacted>-ats.iot.eu-central-1.amazonaws.com  -p 8883 -q 1 -t  ji/tp 
    -i  deviceCert --tls-version tlsv1.2 -m '{"let-me": "in"}' -d

Doing this, I know that the policy attached to my signerCA is correct and running well.

Another verification I’ve done is to check that my coreMQTT connection is correct. To connect without the JITP provisioning, I extracted the device certificate from the ATECC, manually uploaded its PEM and attached a policy to the device in the AWS console.
That MQTT connection was successful (and I see the ‘MQTT.Connect event in the AWS logs).

Here’s the relevant certs description. I’ve redacted the Issuer/Subject from the output so the signatures are incorrect:

The device cert stored in ATECC (the one that does not trigger the provisioning process):

 $ openssl x509 -text -noout -in extracted_device_cert.pm
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:f7:d9:46:59:6e:2f:58:e6:87:04:4f:d5:6e:86:03
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: O = CompanyName, CN = signer.companyname.com FFFF
        Validity
            Not Before: Jan 14 21:00:00 2021 GMT
            Not After : Dec 31 23:59:59 3000 GMT
        Subject: O = CompanyName, CN = pu0223528E47B3461DEE
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:c7:1f:a4:ea:e7:ae:51:16:fb:c3:0b:ce:33:f1:
                    7a:af:f1:27:3a:af:a7:5d:76:76:74:58:e8:56:36:
                    94:56:76:5f:a6:2e:21:53:a5:91:7d:95:f8:9e:0e:
                    f8:ce:bd:d9:c1:50:83:c2:7d:74:98:4b:66:b2:eb:
                    9a:b7:49:48:4c
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Agreement
            X509v3 Subject Key Identifier: 
                4A:F0:38:0D:8E:57:76:71:A2:92:07:B7:60:1B:C7:0A:B4:7E:8B:D1
            X509v3 Authority Key Identifier: 
                keyid:4C:E5:14:B2:9D:3E:8F:29:43:34:45:83:34:C2:F4:09:53:60:13:99

    Signature Algorithm: ecdsa-with-SHA256
         30:44:02:20:5c:86:11:4b:79:07:ce:34:32:61:6d:00:2a:7c:
         43:75:16:e9:b6:ae:13:21:91:25:5f:1b:80:c3:b2:41:93:0d:
         02:20:31:fc:4c:6d:5e:f0:54:46:da:ae:d7:aa:b7:f8:6a:c8:
         21:ba:45:62:31:7b:55:f7:b3:38:af:7c:97:25:81:72

And the manually generated cert that correctly triggers the JITP:

 $ openssl x509 -text -noout -in fakeDeviceCert.pem 
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            7a:50:78:20:5e:dc:de:56:74:55:fb:fa:6e:61:ed:13:ed:c9:0a:b7
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: O = CompanyName, CN = signer.companyname.com FFFF
        Validity
            Not Before: Jan 15 08:22:44 2021 GMT
            Not After : May 23 08:22:44 2999 GMT
        Subject: O = CompanyName, CN = pu010203040506070811
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:62:1e:35:5a:97:ec:7f:f7:82:6e:67:7a:ac:a5:
                    1b:b0:a3:bc:42:08:cb:0e:fe:ad:07:46:0c:dd:8c:
                    ca:b3:60:8f:e3:0b:59:a4:b3:e5:6b:a5:22:8e:49:
                    d3:3a:1e:76:43:7b:7a:cd:dd:0d:dc:52:1f:8f:83:
                    ee:10:e0:fb:1a
                ASN1 OID: prime256v1
                NIST CURVE: P-256
    Signature Algorithm: ecdsa-with-SHA256
         30:46:02:21:00:8f:3a:b4:e4:25:98:3c:79:23:65:e4:1b:68:
         75:19:11:27:91:df:66:22:ea:c1:13:06:72:6f:e0:5d:3d:13:
         49:02:21:00:e2:7e:2b:92:55:68:98:09:b9:a4:e9:7b:2a:7c:
         48:2a:bb:23:c7:45:d2:96:ec:df:9b:62:a8:9d:7a:98:06:fe

Вот описание signerCA от AWS (с некоторыми отредактированными полями между <>)

 $ aws iot describe-ca-certificate --certificate-id <my-ca-cert-id>
{
    "certificateDescription": {
        "certificateArn": "arn:aws:iot:eu-central-1:<accountID>:cacert/<ca-id>",
        "certificateId": "<ca-id>",
        "status": "ACTIVE",
        "certificatePem": "-----BEGIN CERTIFICATE-----n<pem-content>-----END CERTIFICATE-----n",
        "ownedBy": "<owner-account-id>",
        "creationDate": "2021-01-11T10:40:58.736000 01:00",
        "autoRegistrationStatus": "ENABLE",
        "lastModifiedDate": "2021-01-14T23:38:52.132000 01:00",
        "customerVersion": 2,
        "generationId": "09eb8608-630c-4632-a1ef-0879f6f2dd6f",
        "validity": {
            "notBefore": "2020-11-09T18:55:11 01:00",
            "notAfter": "2070-10-28T18:44:12 01:00"
        }
    },
    "registrationConfig": {
        "templateBody": "{"Parameters": {"AWS::IoT::Certificate::CommonName": {"Type": "String"}, "AWS::IoT::Certificate::Id": {"Type": "String"}}, "Resources": {"thing": {"Type": "AWS::IoT::Thing", "Properties": {"ThingName": {"Ref": "AWS::IoT::Certificate::CommonName"}, "AttributePayload": {"version": "v1"}}}, "certificate": {"Type": "AWS::IoT::Certificate", "Properties": {"CertificateId": {"Ref": "AWS::IoT::Certificate::Id"}, "Status": "ACTIVE"}}, "policy": {"Type": "AWS::IoT::Policy", "Properties": {"PolicyDocument": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Action\": [\"iot:Connect\", \"iot:Publish\", \"iot:Subscribe\", \"iot:Receive\", \"iot:GetThingShadow\", \"iot:DeleteThingShadow\", \"iot:UpdateThingShadow\"], \"Resource\": [\"*\"]}]}"}}}}",
        "roleArn": "arn:aws:iam::<account-id>:role/JITP-Role"
    }
}

Я немного растерялся и у меня есть несколько вопросов:

mbedTLS, похоже, представляет два объединенных сертификата. Будет ли рукопожатие успешным, если один из них был неверным или если mbedTLS был неправильно настроен?
Могут ли расширения X509v3 быть причиной сбоя JITP? Сертификат устройства имеет их, а созданный вручную — нет.
Есть ли способ регистрировать сбои взаимной аутентификации в Cloudwatch?

Есть ли что-нибудь, что я пропустил?

(РЕДАКТИРОВАТЬ: если я не включаю signerCA в цепочку сертификатов при подключении, подтверждение связи TLS по-прежнему выполняется успешно. Конечно, в этом случае я ожидаю, что процесс JITP завершится неудачей, потому что AWS не может найти соответствующий центр сертификации).

РЕДАКТИРОВАНИЕ 2: я пытался подключиться к mosquitto и сертификату, который намного ближе к тому, который используется ATECC (те же алгоритмы и те же расширения X509v3). Результат тот же: сертификат, созданный вручную с помощью mosquitto, может вызвать JITP, а сертификат из ATECC — нет.

Ответ №1:

Понял. Я получал открытый ключ моего корневого сертификата в неправильном слоте в ATECC (ой). Это привело к atcacert_def_t тому, что signerCA и шаблон во время выполнения немного отличались друг от друга.

Я пропустил это, потому что все мои инструменты в Python выбирали правильный слот, в то время как версия C не была полностью синхронизирована.

Вопрос:

Ответ №1:

Вам также может понравиться

Acumatica — состояние дел Comboxbox

Запись выделенной памяти на диск

ширина @Html.DropDownList