mirror of
https://github.com/obgm/libcoap.git
synced 2026-10-26 20:51:38 +03:00
Jon Shallow
d40f2d6a3f
Currently OpenSSL and MBedTLS do not support RFC7250. See https://en.wikipedia.org/wiki/Comparison_of_TLS_implementations#Extensions last column. GnuTLS >= 3.6.6 required. TinyDTLS update required. New option is_rpk_not_cert added to PKI setup structure which is enabled in coap-client and coap-server by the -M option and the use of a PUBLIC KEY instead of a CERTIFICATE in the cert file. If file is EC PRIVATE KEY, then it can be used for both the public and private key files. man/coap-client.txt.in: man/coap-server.txt.in: Document -M option. man/coap_encryption.txt.in: man/coap-server.txt.in: man/coap_context.txt.in: Add in documentation for RPK. examples/client.c: examples/coap-server.c: Add in support for is_rpk_not_cert and -M option. Stop sending ::1 for SNI - use localhost instead. include/coap2/coap_dtls.h: Add in is_rpk_not_cert option. include/coap2/str.h: src/str.c: libcoap-2.map: libcoap-2.sym: Add in coap_new_binary() and coap_delete_binary() functions. src/coap_openssl.c: Report RPK is not supported if invoked. Check that all received data is used up for error recovery. src/coap_mbedtls.c: Report RPK is not supported if invoked. Handle more MbedTLS generated errors. Check that all received data is used up for error recovery. src/coap_gnutls.c: Add in support for RPK. Add in sending Hello Verify if not cookie match in Client Hello Check that all received data is used up for error recovery. src/coap_tinydtls.c: Add in support for RPK. HOWTO.pkcs11: Update for use with RPK. Use .der file for '-C ca_file' definitions as later GnuTLS needs CA to be trusted in HSM.
116 lines
4.3 KiB
Plaintext
116 lines
4.3 KiB
Plaintext
#
|
|
# Using PKCS11 with libcoap.
|
|
#
|
|
# This HOWTO works for CentOS 7.
|
|
#
|
|
# As CentOS 7 uses OpenSSL prior to 1.1.0, dual OpenSSL support needs to be
|
|
# set up and used for libcoap. See HOWTO.dual.openssl for setting this up.
|
|
#
|
|
# It also is possible that you want to use GnuTLS - and want to use a later
|
|
# version. HOWTO.dual.gnutls for setting this up.
|
|
#
|
|
# OpenSSL and GnuTLS are currently supported
|
|
#
|
|
|
|
############################################################################
|
|
#
|
|
# Testing examples
|
|
#
|
|
############################################################################
|
|
#
|
|
# Update PKCS11 token with certificates and keys
|
|
#
|
|
# Assumption is that you already have the following PEM files
|
|
# ca-cert.pem - The certificate of the CA that signed Server and Client
|
|
# server-cert.pem - Contains the server certificate in PEM format
|
|
# server-key.pem - Contains the server private key in PEM format
|
|
# client-cert.pem - Contains the server certificate in PEM format
|
|
# client-key.pem - Contains the server private key in PEM format
|
|
#
|
|
# Tokens will be stored under /var/lib/softhsm/tokens/
|
|
#
|
|
|
|
# Initialize Soft HSM token
|
|
# Note: slot 0 is re-allocated to slot XXX. This is presented as a decimal
|
|
# number, the hex equivalent (leading 0x) can be used for any slot options..
|
|
# Set SO PIN to 4321, user PIN to 1234
|
|
softhsm2-util --init-token --slot 0 --label "token-0" --pin 1234 --so-pin 4321
|
|
|
|
# CA Certificate (different id to Server/Client Public Certificate)
|
|
openssl x509 -in ca-cert.pem -out ca-cert.der -outform DER
|
|
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --pin 1234 \
|
|
--write-object ./ca-cert.der --type cert --id cc00 --label "ca-cert" \
|
|
--token-label "token-0"
|
|
|
|
# Server Private Key
|
|
openssl pkcs8 -topk8 -inform PEM -outform PEM -in server-key.pem \
|
|
-out server-key.pk8 -nocrypt
|
|
softhsm2-util --import server-key.pk8 --label "server-key" --id aa00 \
|
|
--pin 1234 --token "token-0"
|
|
|
|
# Server Public Certificate
|
|
# (Use different id to private key, but not the same as CA/Client cert)
|
|
openssl x509 -in server-cert.pem -out server-cert.der -outform DER
|
|
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --pin 1234 \
|
|
--write-object ./server-cert.der --type cert --id aa01 \
|
|
--label "server-cert" --token-label "token-0"
|
|
|
|
# Client Private Key
|
|
openssl pkcs8 -topk8 -inform PEM -outform PEM -in client-key.pem \
|
|
-out client-key.pk8 -nocrypt
|
|
softhsm2-util --import client-key.pk8 --label "client-key" --id bb00 \
|
|
--pin 1234 --token "token-0"
|
|
|
|
# Client Public Certificate
|
|
# (Use different id to private key, but not the same as CA/Client cert)
|
|
openssl x509 -in client-cert.pem -out client-cert.der -outform DER
|
|
pkcs11-tool --module /usr/local/lib/softhsm/libsofthsm2.so --pin 1234 \
|
|
--write-object ./client-cert.der --type cert --id bb01 \
|
|
--label "client-cert" --token-label "token-0"
|
|
|
|
# Verify token is correctly populated
|
|
pkcs11-tool --module=/usr/local/lib/softhsm/libsofthsm2.so -t
|
|
pkcs11-tool --module=/usr/local/lib/softhsm/libsofthsm2.so --list-objects \
|
|
--pin 1234 --token-label "token-0"
|
|
|
|
#
|
|
# Run coap-server using PKCS11 (-C option may need to be -C cert.der)
|
|
#
|
|
coap-server -C 'pkcs11:token=token-0;id=%cc%00?pin-value=1234' \
|
|
-c 'pkcs11:token=token-0;id=%aa%01?pin-value=1234' \
|
|
-j 'pkcs11:token=token-0;id=%aa%00?pin-value=1234' -v9 -n
|
|
|
|
# or
|
|
coap-server -C 'pkcs11:token=token-0;id=%cc%00' \
|
|
-c 'pkcs11:token=token-0;id=%aa%01' \
|
|
-j 'pkcs11:token=token-0;id=%aa%00' -J 1234 -v9 -n
|
|
|
|
# or
|
|
coap-server -C 'pkcs11:token=token-0;object=ca-cert' \
|
|
-c 'pkcs11:token=token-0;object=server-cert' \
|
|
-j 'pkcs11:token=token-0;object=server-key' -J 1234 -v9 -n
|
|
|
|
#
|
|
# Run coap-client using PKCS11 (-C option may need to be -C cert.der)
|
|
#
|
|
coap-client -C 'pkcs11:token=token-0;id=%cc%00?pin-value=1234' \
|
|
-c 'pkcs11:token=token-0;id=%bb%01?pin-value=1234' \
|
|
-j 'pkcs11:token=token-0;id=%bb%00?pin-value=1234' -v9 coaps://[::1]
|
|
|
|
# or
|
|
coap-client -C 'pkcs11:token=token-0;id=%cc%00' \
|
|
-c 'pkcs11:token=token-0;id=%bb%01' \
|
|
-j 'pkcs11:token=token-0;id=%bb%00' -J 1234 -v9 coaps://[::1]
|
|
|
|
# or
|
|
coap-client -C 'pkcs11:token=token-0;object=ca-cert' \
|
|
-c 'pkcs11:token=token-0;object=client-cert' \
|
|
-j 'pkcs11:token=token-0;object=client-key' -J 1234 -v9 coaps://[::1]
|
|
|
|
#
|
|
# Client and Server using RPK (GnuTLS only)
|
|
#
|
|
coap-server -M 'pkcs11:token=token-0;object=server-key' -J 1234 -v9 -n
|
|
# and
|
|
coap-client -M 'pkcs11:token=token-0;object=client-key' -J 1234 -v9 coaps://[::1]
|