未使用 mbedTLS+ATECC608A 创建 JITP 证书（与 moquitto_pub 一起使用）
Posted
技术标签:
【中文标题】未使用 mbedTLS+ATECC608A 创建 JITP 证书（与 moquitto_pub 一起使用）【英文标题】：JITP cert not created with mbedTLS+ATECC608A (works with moquitto_pub) 【发布时间】：2021-04-20 10:27:23 【问题描述】：我有以下设置：
ATECC608A mbedTLS（使用 2.16.6 和 2.16.9 测试） 核心MQTT 证书链如下：RootCA > SignerCA > DeviceCert。我已在 AWS IoT 控制台中将 RootCA 和 SignerCA 注册为 CA我在 mbedTLS 中设置了以下链：
/* Extract the device certificate and convert to mbedtls cert */
if (0 != atca_mbedtls_cert_add(&device_cert_chain, &g_cert_def_2_device))
printf("Failed to parse device cert from device\n");
goto exit;
/* Extract the signer certificate, convert, then attach to the chain */
if (0 != atca_mbedtls_cert_add(&device_cert_chain, &g_cert_def_1_signer))
printf("Failed to parse signer cert from device\n");
goto exit;
当使用该堆栈连接到我的 ats-endpoint 时，TLS 握手是成功的：设备证书和签名者CA 被呈现，AWS 也呈现其证书链。 mbedTLS 似乎很高兴：
....[SNIP]
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:2898: <= parse server hello done
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3522: client state: 7
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2765: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5343: => write certificate
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: own certificate #1:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: cert. version : 3
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: serial number : 40:F7:D9:46:59:6E:2F:58:E6:87:04:4F:D5:6E:86:03
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issuer name : O=CompanyName, CN=signer.companyname.com FFFF
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: subject name : O=CompanyName, CN=pu0223528E47B3461DEE
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issued on : 2021-01-14 21:00:00
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: expires on : 3000-12-31 23:59:59
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: signed using : ECDSA with SHA256
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: EC key size : 256 bits
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: basic constraints : CA=false
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: key usage : Digital Signature, Key Agreement
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(X)' (256 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: c7 1f a4 ea e7 ae 51 16 fb c3 0b ce 33 f1 7a af
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: f1 27 3a af a7 5d 76 76 74 58 e8 56 36 94 56 76
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(Y)' (255 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: 5f a6 2e 21 53 a5 91 7d 95 f8 9e 0e f8 ce bd d9
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: c1 50 83 c2 7d 74 98 4b 66 b2 eb 9a b7 49 48 4c
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: own certificate #2:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: cert. version : 3
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: serial number : 4D:29:66:FF:B8:09:8D:39:0E:39:C8:3A:94:6E:EE:6A
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issuer name : O=CompanyName, CN=root.companyname.com FFFF
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: subject name : O=CompanyName, CN=signer.companyname.com FFFF
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issued on : 2020-11-09 17:55:11
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: expires on : 2070-10-28 17:44:12
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: signed using : ECDSA with SHA256
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: EC key size : 256 bits
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: basic constraints : CA=true
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: key usage : Digital Signature, Key Cert Sign, CRL Sign
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(X)' (256 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: cc 63 87 d3 bd 58 08 1e c7 55 02 be a8 e1 d7 a2
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: f9 7f 62 0a 39 c6 40 45 cf 1d 83 4a 53 5e 6a e3
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(Y)' (255 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: 5b be ad 83 96 10 3c 0e 5b 0b 60 32 65 5d d3 3b
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: 77 90 b2 a7 a8 cb 90 b7 49 3f 24 cd c6 6b 1f 38
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3192: => write handshake message
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3351: => write record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3428: output record: msgtype = 22, version = [3:3], msglen = 982
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: dumping 'output record sent to network' (987 bytes)
....[SNIP]
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4399: <= read record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6606: <= parse finished
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3522: client state: 14
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2765: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3633: handshake: done
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3522: client state: 15
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2765: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6350: => handshake wrapup
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6323: => handshake wrapup: final free
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6343: <= handshake wrapup: final free
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6405: <= handshake wrapup
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8108: <= handshake
ok
TLS Session Established and a Socket is ready for an Application
然后我使用创建的 mbedtls_ssl_context 连接 coreMQTT。从日志中，coreMQTT 能够在套接字上写入，但 AWS 关闭了连接。
...[SNIP]...
TLS Session Established and a Socket is ready for an Application
Initializing MQTT...ok
Connecting to the MQTT broker with params:
- identifier='testclient'
- username='?SDK=Fedora&Version=33&Platform=PC&MQTTLib=core-mqtt@v1.1.0'
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8696: => write
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3351: => write record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1443: => encrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: dumping 'before encrypt: output payload' (85 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0000: 10 53 00 04 4d 51 54 54 04 82 00 3c 00 0a 74 65 .S..MQTT...<..te
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0010: 73 74 63 6c 69 65 6e 74 00 3b 3f 53 44 4b 3d 46 stclient.;?SDK=F
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0020: 65 64 6f 72 61 26 56 65 72 73 69 6f 6e 3d 33 33 edora&Version=33
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0030: 26 50 6c 61 74 66 6f 72 6d 3d 50 43 26 4d 51 54 &Platform=PC&MQT
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0040: 54 4c 69 62 3d 63 6f 72 65 2d 6d 71 74 74 40 76 TLib=core-mqtt@v
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0050: 31 2e 31 2e 30 1.1.0
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1572: dumping 'additional data for AEAD' (13 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1572: 0000: 00 00 00 00 00 00 00 01 17 03 03 00 55 ............U
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1602: dumping 'IV used (internal)' (12 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1602: 0000: 91 d1 a1 52 00 00 00 00 00 00 00 01 ...R........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1604: dumping 'IV used (transmitted)' (8 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1604: 0000: 00 00 00 00 00 00 00 01 ........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1614: before encrypt: msglen = 93, including 0 bytes of padding
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1641: dumping 'after encrypt: tag' (16 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1641: 0000: db 24 89 b1 5f 7f e6 ff 78 dd c3 8b 34 99 79 1f .$.._...x...4.y.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1779: <= encrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3428: output record: msgtype = 23, version = [3:3], msglen = 109
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: dumping 'output record sent to network' (114 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0000: 17 03 03 00 6d 00 00 00 00 00 00 00 01 ba 08 e9 ....m...........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0010: fb f4 64 84 4e 6d 31 6e 89 3f 7b 74 e1 9a 0a af ..d.Nm1n.?t....
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0020: 82 33 4e 7b 13 23 de ba 55 19 41 24 6e 95 14 3c .3N.#..U.A$n..<
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0030: 2a 6e 02 67 6d 76 4d f8 32 a0 45 ca 12 a2 1a 31 *n.gmvM.2.E....1
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0040: 97 26 45 13 88 07 2c 18 13 ab 92 4b 2b 98 41 49 .&E...,....K+.AI
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0050: 03 5a 4f a9 5d 95 33 2b 68 c9 16 ee 2a ad 59 0a .ZO.].3+h...*.Y.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0060: 7a 52 db 24 89 b1 5f 7f e6 ff 78 dd c3 8b 34 99 zR.$.._...x...4.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0070: 79 1f y.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2771: message length: 114, out_left: 114
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2777: ssl->f_send() returned 114 (-0xffffff8e)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2805: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3484: <= write record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8724: <= write
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8284: => read
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4325: => read record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2534: => fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2694: in_left: 0, nb_want: 5
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2718: in_left: 0, nb_want: 5
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2720: ssl->f_recv(_timeout)() returned 5 (-0xfffffffb)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2740: <= fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4061: dumping 'input record header' (5 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4061: 0000: 15 03 03 00 1a .....
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4067: input record: msgtype = 21, version = [3:3], msglen = 26
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2534: => fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2694: in_left: 5, nb_want: 31
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2718: in_left: 5, nb_want: 31
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2720: ssl->f_recv(_timeout)() returned 26 (-0xffffffe6)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2740: <= fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4246: dumping 'input record from network' (31 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4246: 0000: 15 03 03 00 1a 00 00 00 00 00 00 00 01 33 90 3f .............3.?
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4246: 0010: df 0b 29 53 90 20 f1 90 14 82 84 99 e9 f6 db ..)S. .........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1792: => decrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1879: dumping 'additional data for AEAD' (13 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1879: 0000: 00 00 00 00 00 00 00 01 15 03 03 00 02 .............
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1908: dumping 'IV used' (12 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1908: 0000: 3a e9 5a f2 00 00 00 00 00 00 00 01 :.Z.........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1909: dumping 'TAG used' (16 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1909: 0000: 3f df 0b 29 53 90 20 f1 90 14 82 84 99 e9 f6 db ?..)S. .........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2374: <= decrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4273: dumping 'input payload after decrypt' (2 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4273: 0000: 01 00 ..
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5183: got an alert message, type: [1:0]
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5199: is a close notify message
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4383: mbedtls_ssl_handle_message_type() returned -30848 (-0x7880)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8349: mbedtls_ssl_read_record() returned -30848 (-0x7880)
我预计第一次连接会失败。但在这种情况下，证书不会出现在 AWS IoT 控制台中，随后的连接尝试也会失败。
我仔细检查了存储的 signerCA 及其策略。他们看起来很好。为了确保此配置正确，我在我的机器上手动创建了一个证书并使用我的 SignerCA 对其进行了签名。然后我将该证书与 mosquitto_pub 一起使用。该过程有效，我的证书出现在 AWS IoT 控制台中，并附有正确的策略。这是我正在做的事情的日志：
$ openssl genpkey -out fakeDeviceCert.key -algorithm EC -pkeyopt ec_paramgen_curve:P-256
$ openssl req -new -key fakeDeviceCert.key -out fakeDeviceCert.csr
$ openssl x509 -req -in fakeDeviceCert.csr -CA ../certs/signer-FFFF.crt \
-CAkey ../certs/signer-FFFF.key \
-CAcreateserial \
-out fakeDeviceCert.pem \
-days 357335 \
-sha256
$ cat fakeDeviceCert.pem ../certs/signer-FFFF.crt > deviceCertAndCACert.crt
$ mosquitto_pub --cafile AmazonRootCA1.pem \
--cert deviceCertAndCACertcrt --key fakeDeviceCert.key \
-h <redacted>-ats.iot.eu-central-1.amazonaws.com -p 8883 -q 1 -t ji/tp \
-i deviceCert --tls-version tlsv1.2 -m '"let-me": "in"' -d
这样做，我知道附加到我的 signerCA 的策略是正确的并且运行良好。
我所做的另一项验证是检查我的 coreMQTT 连接是否正确。为了在没有 JITP 配置的情况下进行连接，我从 ATECC 中提取了设备证书，手动上传了其 PEM 并将策略附加到 AWS 控制台中的设备。 该 MQTT 连接成功（并且我在 AWS 日志中看到了 'MQTT.Connect 事件）。
这是相关的证书说明。我已经从输出中编辑了颁发者/主题，因此签名不正确：
存储在 ATECC 中的设备证书（不触发配置过程的设备证书）：
$ openssl x509 -text -noout -in extracted_device_cert.pm
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
40:f7:d9:46:59:6e:2f:58:e6:87:04:4f:d5:6e:86:03
Signature Algorithm: ecdsa-with-SHA256
Issuer: O = CompanyName, CN = signer.companyname.com FFFF
Validity
Not Before: Jan 14 21:00:00 2021 GMT
Not After : Dec 31 23:59:59 3000 GMT
Subject: O = CompanyName, CN = pu0223528E47B3461DEE
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:c7:1f:a4:ea:e7:ae:51:16:fb:c3:0b:ce:33:f1:
7a:af:f1:27:3a:af:a7:5d:76:76:74:58:e8:56:36:
94:56:76:5f:a6:2e:21:53:a5:91:7d:95:f8:9e:0e:
f8:ce:bd:d9:c1:50:83:c2:7d:74:98:4b:66:b2:eb:
9a:b7:49:48:4c
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Key Usage: critical
Digital Signature, Key Agreement
X509v3 Subject Key Identifier:
4A:F0:38:0D:8E:57:76:71:A2:92:07:B7:60:1B:C7:0A:B4:7E:8B:D1
X509v3 Authority Key Identifier:
keyid:4C:E5:14:B2:9D:3E:8F:29:43:34:45:83:34:C2:F4:09:53:60:13:99
Signature Algorithm: ecdsa-with-SHA256
30:44:02:20:5c:86:11:4b:79:07:ce:34:32:61:6d:00:2a:7c:
43:75:16:e9:b6:ae:13:21:91:25:5f:1b:80:c3:b2:41:93:0d:
02:20:31:fc:4c:6d:5e:f0:54:46:da:ae:d7:aa:b7:f8:6a:c8:
21:ba:45:62:31:7b:55:f7:b3:38:af:7c:97:25:81:72
以及正确触发 JITP 的手动生成的证书：
$ openssl x509 -text -noout -in fakeDeviceCert.pem
Certificate:
Data:
Version: 1 (0x0)
Serial Number:
7a:50:78:20:5e:dc:de:56:74:55:fb:fa:6e:61:ed:13:ed:c9:0a:b7
Signature Algorithm: ecdsa-with-SHA256
Issuer: O = CompanyName, CN = signer.companyname.com FFFF
Validity
Not Before: Jan 15 08:22:44 2021 GMT
Not After : May 23 08:22:44 2999 GMT
Subject: O = CompanyName, CN = pu010203040506070811
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:62:1e:35:5a:97:ec:7f:f7:82:6e:67:7a:ac:a5:
1b:b0:a3:bc:42:08:cb:0e:fe:ad:07:46:0c:dd:8c:
ca:b3:60:8f:e3:0b:59:a4:b3:e5:6b:a5:22:8e:49:
d3:3a:1e:76:43:7b:7a:cd:dd:0d:dc:52:1f:8f:83:
ee:10:e0:fb:1a
ASN1 OID: prime256v1
NIST CURVE: P-256
Signature Algorithm: ecdsa-with-SHA256
30:46:02:21:00:8f:3a:b4:e4:25:98:3c:79:23:65:e4:1b:68:
75:19:11:27:91:df:66:22:ea:c1:13:06:72:6f:e0:5d:3d:13:
49:02:21:00:e2:7e:2b:92:55:68:98:09:b9:a4:e9:7b:2a:7c:
48:2a:bb:23:c7:45:d2:96:ec:df:9b:62:a8:9d:7a:98:06:fe
这是来自 AWS 的 signerCA 描述（在 之间有一些编辑字段）
$ aws iot describe-ca-certificate --certificate-id <my-ca-cert-id>
"certificateDescription":
"certificateArn": "arn:aws:iot:eu-central-1:<accountID>:cacert/<ca-id>",
"certificateId": "<ca-id>",
"status": "ACTIVE",
"certificatePem": "-----BEGIN CERTIFICATE-----\n<pem-content>-----END CERTIFICATE-----\n",
"ownedBy": "<owner-account-id>",
"creationDate": "2021-01-11T10:40:58.736000+01:00",
"autoRegistrationStatus": "ENABLE",
"lastModifiedDate": "2021-01-14T23:38:52.132000+01:00",
"customerVersion": 2,
"generationId": "09eb8608-630c-4632-a1ef-0879f6f2dd6f",
"validity":
"notBefore": "2020-11-09T18:55:11+01:00",
"notAfter": "2070-10-28T18:44:12+01:00"
,
"registrationConfig":
"templateBody": "\"Parameters\": \"AWS::IoT::Certificate::CommonName\": \"Type\": \"String\", \"AWS::IoT::Certificate::Id\": \"Type\": \"String\", \"Resources\": \"thing\": \"Type\": \"AWS::IoT::Thing\", \"Properties\": \"ThingName\": \"Ref\": \"AWS::IoT::Certificate::CommonName\", \"AttributePayload\": \"version\": \"v1\", \"certificate\": \"Type\": \"AWS::IoT::Certificate\", \"Properties\": \"CertificateId\": \"Ref\": \"AWS::IoT::Certificate::Id\", \"Status\": \"ACTIVE\", \"policy\": \"Type\": \"AWS::IoT::Policy\", \"Properties\": \"PolicyDocument\": \"\\\"Version\\\": \\\"2012-10-17\\\", \\\"Statement\\\": [\\\"Effect\\\": \\\"Allow\\\", \\\"Action\\\": [\\\"iot:Connect\\\", \\\"iot:Publish\\\", \\\"iot:Subscribe\\\", \\\"iot:Receive\\\", \\\"iot:GetThingShadow\\\", \\\"iot:DeleteThingShadow\\\", \\\"iot:UpdateThingShadow\\\"], \\\"Resource\\\": [\\\"*\\\"]]\"",
"roleArn": "arn:aws:iam::<account-id>:role/JITP-Role"
我有点迷茫，有几个问题：
mbedTLS 似乎提供了两个连接的证书。如果其中一个不正确或 mbedTLS 配置错误，握手会成功吗？ X509v3 扩展是否会导致 JITP 失败？设备证书有，而手动生成的没有。 有没有办法在 Cloudwatch 中记录相互身份验证失败？我有什么遗漏的吗？
（编辑：如果我在连接时没有在证书链中包含 signerCA，则 TLS 握手仍然成功。当然，在这种情况下，我希望 JITP 进程失败，因为 AWS 找不到关联的 CA）。
编辑2： 我试图连接 mosquitto 和一个更接近 ATECC 使用的证书（相同的算法和相同的 X509v3 扩展）。结果是一样的：手动生成的mosquitto可以触发JITP，而ATECC的则不能。
【问题讨论】：
【参考方案1】：知道了。我在 ATECC 的错误插槽中检索我的根证书的公钥（哎哟）。这导致 atcacert_def_t 和模板在运行时生成的签名者CA 略有不同。
我错过了它，因为我在 Python 中的所有工具都在获取 right 槽，而 C 版本没有完全同步。
【讨论】：
以上是关于未使用 mbedTLS+ATECC608A 创建 JITP 证书（与 moquitto_pub 一起使用）的主要内容，如果未能解决你的问题，请参考以下文章
mbedtls 和 openssl 之间的不同 AES-256 加密输出