RE: Connect to AVNET iotconnect.io with Node-RED - part 8a: safer connect with Self Signed Certificates

Jan Cumps — Fri, 09 Apr 2021 21:39:10 GMT

Initially, I intended to skip self signed certificates, and step directly to CA generated ones.

But I spent a day trying and didn't get a working connection.

You need 3 sets of artifacts:

a root CA certificate-key pair
a proof of ownership (validation) certificate generated by that root CA and its private key
a client certificate-key pair, also generated by that root CA and its private key

I'm successful with step one and 2.

I can create a root certificate and its key, then upload it to the IoTConnect servers.

This generates a challenge token. You need to generate the validation certificate with the challenge as the certificate's common name. Then upload that to the server.

If that's successful, the CA certificate is accepted as a source for client certificates.

As you can see, I've been quite busy:

[View:/resized-image/__size/620x99/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-cf44497e-4ff1-4f68-9f90-3e61bafb4f13/1731.contentimage_5F00_207914.png:620:99]

Certificate 2 and 3 are trials with OpenSSL on linux.

The first one is generated on Windows - following Azure's instructions (IoTConnect runs on Azure servers and stack).

Each time the results are the same: the validation certificate is OK. It marks the CA as verified on the server.

(I also did negative tests: un purpose gave wrong info in the verify certificate, to see if the validation is real. It is real).

But the client can't connect with the client certificate I generate:

[View:/resized-image/__size/620x217/__key/commentfiles/f7d226abd59f475c9d224a79e3f0ec07-cf44497e-4ff1-4f68-9f90-3e61bafb4f13/4863.contentimage_5F00_207915.png:620:217]

I've entered a support request for IoTConnect support:

I am able to connect a device with the CPID/Unique ID combination, and with a Self Signed certificate

https://www.element14.com/community/community/applications/industrial-automation-space/blog/2021/04/09/connect-to-avnet-iotconnectio-with-node-red-part-8a-safer-connect-with-certificates

I am also able to generate and upload a CA certificate to the portal, then generate a validation certificate and validate the CA successfully.

However, when I create a CA template, then a device that uses that template and my verified CA, it fails to connect from Node-RED.

symptom:

Node shows as disconnected.

Node-RED log: Connection closed ::: DeviceId :: *********************-e14cacert1 :: 2021-04-09T15:19:39.818Z

I created the client certificate and key in a similar way as the verification certificate I used to proof that I own the CA certificate.