JITR in mbedtls

parkhyunung · October 26, 2020, 10:12am

In the current, I have one problem with JITR

As I know, It must be sent the certificate which is concatenated a device certificate and ca certificate to AWS IoT Service

How do I use using mbedtls_x509_crt_parse API etc?

yanesca · October 27, 2020, 9:17am

Hi,

Have you tried using mbedtls_x509write_crt_pem()?

github.com

Mbed-TLS/mbedtls/blob/development/include/mbedtls/x509_crt.h#L1075


      
          *
          * \param ctx       CRT context to use
          * \param md_alg    MD algorithm to use
          */
          void mbedtls_x509write_crt_set_md_alg(mbedtls_x509write_cert *ctx, mbedtls_md_type_t md_alg);
          
          
/**
          * \brief           Generic function to add to or replace an extension in the
          *                  CRT
          *
          * \param ctx       CRT context to use
          * \param oid       OID of the extension
          * \param oid_len   length of the OID
          * \param critical  if the extension is critical (per the RFC's definition)
          * \param val       value of the extension OCTET STRING
          * \param val_len   length of the value data
          *
          * \return          0 if successful, or a MBEDTLS_ERR_X509_ALLOC_FAILED
          */
          int mbedtls_x509write_crt_set_extension(mbedtls_x509write_cert *ctx,
                                                 const char *oid, size_t oid_len,

Also, I think that questions like this are more likely to get answered on the Mbed TLS mailing list:
https://lists.trustedfirmware.org/mailman/listinfo/mbed-tls
and it is worth considering to send them there.

Best regards,
Janos

parkhyunung · October 28, 2020, 5:48am

Hi

I make a certificate using BouncyCastle lib in android app as the below.

JITR is not working.

Namely a device certificate is not registered in aws iot.

In case of making ca certificate using openssl, JITR works normally.

Could you please help me?

-----BEGIN CERTIFICATE-----

MIIB8jCCAZegAwIBAgIVAK0ct2HFXVdS/k2NblxYGoxyuabfMAoGCCqGSM49BAMC

MDIxCzAJBgNVBAYTAktSMRAwDgYDVQQKDAdUcnVzdEZpMREwDwYDVQQDDAhtZWdh

em9uZTAeFw0yMDEwMjcwMDAwMDBaFw0zNTAxMDEwMDAwMDBaMDIxCzAJBgNVBAYT

AktSMRAwDgYDVQQKDAdUcnVzdEZpMREwDwYDVQQDDAhtZWdhem9uZTBZMBMGByqG

SM49AgEGCCqGSM49AwEHA0IABEknYdqI3CdVlmMkTmqKS63HnHc5PbyBff1RokGG

6NE6z31ilA8Yt2fGFHIln1kQtx//6stBA1bIqiqsSo8wad6jgYkwgYYwHQYDVR0O

BBYEFBHaQtHvagaDPkpWxQurErTekm2cMB8GA1UdIwQYMBaAFBHaQtHvagaDPkpW

xQurErTekm2cMA8GA1UdEwEB/wQFMAMBAf8wEQYJYIZIAYb4QgEBBAQDAgAHMAsG

A1UdDwQEAwIBBjATBgNVHSUEDDAKBggrBgEFBQcDAzAKBggqhkjOPQQDAgNJADBG

AiEA9HSXn3FpGUYLagsI3qaHz3VicMSuADUz/QBYEKN9STkCIQC+8BX/TPADpPOy

ClmBIkjxdDt0Fh7HTDn9UwBUxYA3/g==

-----END CERTIFICATE-----

-----BEGIN EC PRIVATE KEY-----

MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQgU9pUZUfplZyhC+mH

Pt8pthLItdpbJ+Qy47r7gJKTNvCgCgYIKoZIzj0DAQehRANCAARJJ2HaiNwnVZZj

JE5qikutx5x3OT28gX39UaJBhujROs99YpQPGLdnxhRyJZ9ZELcf/+rLQQNWyKoq

rEqPMGne

-----END EC PRIVATE KEY-----

BRs.

Hyunung Park

(Attachment megazone_ca.crt is missing)

(Attachment megazone_ca.key is missing)

parkhyunung · October 28, 2020, 5:49am

Hi

I make a certificate using BouncyCastle lib in android app as the below.