mirror of
https://github.com/obgm/libcoap.git
synced 2026-11-04 08:55:40 +03:00
Jon Shallow
9443d9034a
Add in a new PKI_KEY type for PKCS11 URI to get the PKI information from a smart card or HSM device. Currently only OpenSSL and GnuTLS are supported. Makefile.am: Do not expose coap_dtls_shutdown() function. examples/client.c: examples/coap-server.c: Add in support for using pkcs11: URIs for defining the Certificates and Private Keys. include/coap2/coap_dtls.h: Add in COAP_PKI_KEY_PKCS11 Key type. man/coap-client.txt.in: man/coap-server.txt.in: Update documentation for supporting PKCS11. man/coap_encryption.txt.in: Add in documentation for COAP_PKI_KEY_PKCS11. Correct some typos. HOWTO.dual.gnutls (new): HOWTO.dual.openssl (new): HOWTO.dual.softhsm2 (new): HOWTO.pkcs11 (new): HowTo information. src/coap_gnutls.c: src/coap_openssl.c: Add in PKCS11 support. src/coap_mbedtls.c: PKCS11 not yet supported. Add in no-op coap_dtls_shutdown() function. src/coap_notls.c: src/coap_tinydtls.c: Add in no-op coap_dtls_shutdown() function. src/net.c: Invoke coap_dtls_shutdown() function in coap_cleanup(). NOTE: There are memory leaks after cleanly closing down. These are not within libcoap as far as can be determined. These leaks are a work in progress.
110 lines
4.1 KiB
Plaintext
110 lines
4.1 KiB
Plaintext
#
|
|
# Using PKCS11 with libcoap.
|
|
#
|
|
# This HOWTO works for CentOS 7.
|
|
#
|
|
# As CentOS 7 uses OpenSSL prior to 1.1.0, dual OpenSSL support needs to be
|
|
# set up and used for libcoap. See HOWTO.dual.openssl for setting this up.
|
|
#
|
|
# It also is possible that you want to use GnuTLS - and want to use a later
|
|
# version. HOWTO.dual.gnutls for setting this up.
|
|
#
|
|
# OpenSSL and GnuTLS are currently supported
|
|
#
|
|
|
|
############################################################################
|
|
#
|
|
# Testing examples
|
|
#
|
|
############################################################################
|
|
#
|
|
# Update PKCS11 token with certificates and keys
|
|
#
|
|
# Assumption is that you already have the following PEM files
|
|
# ca-cert.pem - The certificate of the CA that signed Server and Client
|
|
# server-cert.pem - Contains the server certificate in PEM format
|
|
# server-key.pem - Contains the server private key in PEM format
|
|
# client-cert.pem - Contains the server certificate in PEM format
|
|
# client-key.pem - Contains the server private key in PEM format
|
|
#
|
|
# Tokens will be stored under /var/lib/softhsm/tokens/
|
|
#
|
|
|
|
# Initialize Soft HSM token
|
|
# Note: slot 0 is re-allocated to slot XXX. This is presented as a decimal
|
|
# number, the hex equivalent (leading 0x) can be used for any slot options..
|
|
# Set SO PIN to 4321, user PIN to 1234
|
|
softhsm2-util --init-token --slot 0 --label "token-0" --pin 1234 --so-pin 4321
|
|
|
|
# CA Certificate (different id to Server/Client Public Certificate)
|
|
openssl x509 -in ca-cert.pem -out ca-cert.der -outform DER
|
|
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --pin 1234 \
|
|
--write-object ./ca-cert.der --type cert --id cc00 --label "ca-cert" \
|
|
--token-label "token-0"
|
|
|
|
# Server Private Key
|
|
openssl pkcs8 -topk8 -inform PEM -outform PEM -in server-key.pem \
|
|
-out server-key.pk8 -nocrypt
|
|
softhsm2-util --import server-key.pk8 --label "server-key" --id aa00 \
|
|
--pin 1234 --token "token-0"
|
|
|
|
# Server Public Certificate
|
|
# (Use different id to private key, but not the same as CA/Client cert)
|
|
openssl x509 -in server-cert.pem -out server-cert.der -outform DER
|
|
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --pin 1234 \
|
|
--write-object ./server-cert.der --type cert --id aa01 \
|
|
--label "server-cert" --token-label "token-0"
|
|
|
|
# Client Private Key
|
|
openssl pkcs8 -topk8 -inform PEM -outform PEM -in client-key.pem \
|
|
-out client-key.pk8 -nocrypt
|
|
softhsm2-util --import client-key.pk8 --label "client-key" --id bb00 \
|
|
--pin 1234 --token "token-0"
|
|
|
|
# Client Public Certificate
|
|
# (Use different id to private key, but not the same as CA/Client cert)
|
|
openssl x509 -in client-cert.pem -out client-cert.der -outform DER
|
|
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --pin 1234 \
|
|
--write-object ./client-cert.der --type cert --id bb01 \
|
|
--label "client-cert" --token-label "token-0"
|
|
|
|
# Verify token is correctly populated
|
|
pkcs11-tool --module=/usr/local/lib/softhsm/libsofthsm2.so -t
|
|
pkcs11-tool --module=/usr/local/lib/softhsm/libsofthsm2.so --list-objects \
|
|
--pin 1234 --token-label "token-0"
|
|
|
|
#
|
|
# Run coap-server using PKCS11
|
|
#
|
|
coap-server -C 'pkcs11:token=token-0;id=%cc%00?pin-value=1234' \
|
|
-c 'pkcs11:token=token-0;id=%aa%01?pin-value=1234' \
|
|
-j 'pkcs11:token=token-0;id=%aa%00?pin-value=1234' -v9 -n
|
|
|
|
# or
|
|
coap-server -C 'pkcs11:token=token-0;id=%cc%00' \
|
|
-c 'pkcs11:token=token-0;id=%aa%01' \
|
|
-j 'pkcs11:token=token-0;id=%aa%00' -J 1234 -v9 -n
|
|
|
|
# or
|
|
coap-server -C 'pkcs11:token=token-0;object=ca-cert' \
|
|
-c 'pkcs11:token=token-0;object=server-cert' \
|
|
-j 'pkcs11:token=token-0;object=server-key' -J 1234 -v9 -n
|
|
|
|
#
|
|
# Run coap-client using PKCS11
|
|
#
|
|
coap-client -C 'pkcs11:token=token-0;id=%cc%00?pin-value=1234' \
|
|
-c 'pkcs11:token=token-0;id=%bb%01?pin-value=1234' \
|
|
-j 'pkcs11:token=token-0;id=%bb%00?pin-value=1234' -v9 coaps://[::1]
|
|
|
|
# or
|
|
coap-client -C 'pkcs11:token=token-0;id=%cc%00' \
|
|
-c 'pkcs11:token=token-0;id=%bb%01' \
|
|
-j 'pkcs11:token=token-0;id=%bb%00' -J 1234 -v9 coaps://[::1]
|
|
|
|
# or
|
|
coap-client -C 'pkcs11:token=token-0;object=ca-cert' \
|
|
-c 'pkcs11:token=token-0;object=client-cert' \
|
|
-j 'pkcs11:token=token-0;object=client-key' -J 1234 -v9 coaps://[::1]
|
|
|