• State Resolved
  • Locked Locked
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 41 subscribers
  • Views 753 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC3235SF: Vendor Specific Certificate Catalog and OTP - Not Working

Ben Malchow2
Intellectual 370 points
Part Number: CC3235SF
Other Parts Discussed in Thread: UNIFLASH

Hi,

I am referring to the swru547a.pdf: "Vendor Device Authentication With SimpleLink™ WiFi® Devices" as well as swpu332a.pdf: "SimpleLink™ Wi-Fi® Certificates Handling".

I have created a private key and CSR:

openssl req -newkey rsa:2048 -sha256 -nodes -keyout private.key -out cc3235sf.csr

After creating the CSR and working with DigiCert I have 3 files in "C:\cc3235sf\certs_pem (certificate, intermediate certificate, and root certificate).  So now I am able to use Uniflash command line tools:

/Create certificate catalog:

SLImageCreator.exe tools make_cert_catalog --cert_folder "C:\cc3235sf\certs_der" --out_file "C:\cc3235sf\certificate_Catalog.lst"
Config file (cfg.json) doesn't exist, using defaults

/Sign certificate catalog:

SLImageCreator.exe tools sign --file "C:\cc3235sf\certificate_Catalog.lst" --priv "C:\cc3235sf\private.key" --out_file "C:\cc3235sf\certificate_Catalog.lst.signed.bin" --fmt "BINARY_SHA2"
Config file (cfg.json) doesn't exist, using defaults

Create OTP metadata file:

SLImageCreator.exe tools meta --cert "C:\cc3235sf\certs_pem\DigiCert Assured ID Root CA.pem" --out_file "C:\cc3235sf\otp\vendor_otp.meta" --mac "000000000000" --usechain
Config file (cfg.json) doesn't exist, using defaults

Sign OTP metadata file:

SLImageCreator.exe tools sign --file "C:\cc3235sf\otp\vendor_otp.meta" --priv "C:\cc3235sf\private.key" --out_file "C:\cc3235sf\otp\vendor_otp.meta.sig" --fmt "BINARY_SHA2"
Config file (cfg.json) doesn't exist, using defaults

Create OTP information file:


SLImageCreator.exe tools inf --algo 2 --sign1 "C:\cc3235sf\otp\vendor_otp.meta.sig" --sign2 "C:\cc3235sf\otp\vendor_otp.meta.sig" --meta "C:\cc3235sf\otp\vendor_otp.meta" --out_file "C:\cc3235sf\otp\vendor_otp.inf"
Config file (cfg.json) doesn't exist, using defaults

I then specify the files generated in Uniflash:

Upon programming, this error appears:

Is there anything obvious I am doing wrong?  Any suggestions?

Thanks,

Ben

  • 0
    TI__Guru 63006 points

    Hi,

    I can't open the photos you've added, please try to add jpg file format.

    The C:\cc3235sf\certs_der\ folder should only contain root CA certificates (which makes your certificate catalog). 

    You certificate and any intermediate certificate should be added as user files as used with the TI certificate catalog.

    Br,

    Kopi

  • 0 in reply to Kobi Leibovitch
    Intellectual 370 points

    Hi Kobi,

    Thank you for your reply!

    Here are my commands:

    // Create certificate catalog; folder only contains root CA
    SLImageCreator.exe tools make_cert_catalog --cert_folder "C:\cc3235sf\root_ca" --out_file "C:\cc3235sf\certificate_Catalog.lst"


    // Sign certificate catalog
    SLImageCreator.exe tools sign --file "C:\cc3235sf\certificate_Catalog.lst" --priv "C:\cc3235sf\private.key" --out_file "C:\cc3235sf\certificate_Catalog.lst.signed.bin" --fmt "BINARY_SHA2"


    // Create OTP metadata file.
    SLImageCreator.exe tools meta --cert "C:\cc3235sf\certs_pem\DigiCert Assured ID Root CA.pem" --out_file "C:\cc3235sf\otp\vendor_otp.meta" --mac "000000000000" --usechain


    // Sign OTP metadata file.
    SLImageCreator.exe tools sign --file "C:\cc3235sf\otp\vendor_otp.meta" --priv "C:\cc3235sf\private.key" --out_file "C:\cc3235sf\otp\vendor_otp.meta.sig" --fmt "BINARY_SHA2"


    // Create OTP information file.
    SLImageCreator.exe tools inf --algo 2 --sign1 "C:\cc3235sf\otp\vendor_otp.meta.sig" --sign2 "C:\cc3235sf\otp\vendor_otp.meta.sig" --meta "C:\cc3235sf\otp\vendor_otp.meta" --out_file "C:\cc3235sf\otp\vendor_otp.inf"

    Error is still persisting.  Note, certificate is "Issued To" "Company, Inc."; could name the file "Company, Inc..der" be part of the issue?

  • 0 in reply to Ben Malchow2
    TI__Guru 63006 points

    Hi Ben,

    The OTP verification does not work with a certificate chain. 

    Once you created the key pair, you should use the public key (through the CSR) to create a self signed certificate and store it on the OTP.

    If you've already signed you certificate through a known CA (such as digicert) that is supported by TI cert catalog - you may not need the use the vendor catalog at all.

    Br,

    Kobi

  • 0 in reply to Kobi Leibovitch
    Intellectual 370 points

    Hi Kobi,

    This resolved that issue, thank you.  Have another issue, but it does not pertain to this thread so I'll begin another one.

    Thanks,

    Ben