Other Parts Discussed in Thread: CC3100, CC3200
My customer is having issues in converting certificates with AWS/CC3100.
The certificates are generated by following the instructions in this link:
https://aws.amazon.com/blogs/iot/just-in-time-registration-of-device-certificates-on-aws-iot/
Since the CC3100 requires certificates to be in der format, the customer converted the certificates from their original pem format using the following commands:
$ openssl pkcs7 -print_certs -in deviceCertAndCACert.p7b -text -noout
or
$ openssl pkcs7 -print_certs -in deviceCertAndCACert.p7b -outform der -out deviceCertAndCACert.der
or
$ openssl x509 -outform der -in deviceCertAndCACert.crt -out deviceCertAndCACert.der
The first command:
$ openssl pkcs7 -print_certs -in deviceCertAndCACert.p7b -outform der -out deviceCertAndCACert.der
produces the deviceCertAndCACert.der file and it looks somewhat ok when viewed as hex but when running the following:
$ openssl x509 -inform der -in deviceCertAndCACert.der -text -noout
It yields:
unable to load certificate
9100:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1197:
9100:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:374:Type=X509
With the second command:
$ openssl x509 -outform der -in deviceCertAndCACert.crt -out deviceCertAndCACert.der
produces the deviceCertAndCACert.der file but the file size is too small and when run:
$ openssl x509 -inform der -in deviceCertAndCACert.der -text –noout
Only the first certificate is visible.
It is important to note that those certificates run okay in a Linux machine, e.g., without the participation of the CC3100.
- They used the first command from the Ubuntu/mosquitto MQTT client and it successfully triggered the IoT registration rule. So linux/mosquitto/openssl must know how to transmit the chain in the der format, while the CC3100 seems to have an issue.
Summarizing, when loading the deviceCertAndCACert.der file (generated from the commands above) into the serial flash, the CC3100 fails to connect to the host/create in the SSL session. AWS support confirms the suspicion of a problem with the CC3100.
Can you please share your ideas?
Thank you!
