• State Resolved
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 41 subscribers
  • Views 727 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC3220: I have include the RootCA file in uniflash , why still need the trusted root-certificate catalog?

Yue TANG
Expert 8705 points

Part Number: CC3220

Hi Team,

  Can you please give some help about my question?  if  choosed the newest root-certiciate catalog, I will meet below issue. 

  • 0
    Genius 3005 points
    Hi Yue,

    You need to use the source and signature files from certificate-playground folder. The ones you have shown seem to be from certificate-catalog folder.

    David
  • 0 in reply to david s
    TI__Mastermind 40965 points

    HI Yue,

    As David pointed out, if you are using the dummy cert chain to sign the CC3220 binary, you will need to include the dummy playground certificate catalog in Uniflash. Otherwise, the root CA of the dummy chain will not be recognized, throwing the filesystem error that you see above. Your Uniflash setup should look like this:

    Regards,

    Michael

  • 0 in reply to Michael Reymond
    TI__Expert 8705 points
    Thanks, actually I have got this through experiment. Just wondering why need a Root-CA list? I have alreayd added the specific Root-CA and my certificate into file system. if I used a self-signed certificate , is it ok to not include the Root-CA list?
  • 0 in reply to Yue TANG
    TI__Mastermind 40965 points
    Hi Yue,

    The point of the root CA catalog is so that the CC3220 can decide which root CAs it trusts. This list of trusted root CAs is comparable to similar catalogs distributed with web browsers, operating systems, etc. that allow devices or applications to use a chain of trust. Without a catalog of trusted root CAs, anyone can make a self-signed certificate and then the device would not be able to distinguish the trustworthiness of such a certificate compared to one signed by a well-known root CA.

    If you wanted to use a self-signed certificate, you will have to follow the steps provided in the vendor device authentication appnote:
    www.ti.com/.../swru547.pdf
    This involves programming the OTP region of the CC3220.

    Regards,
    Michael