Trouble creating a create a certificate signing request on nrf5340 for BLE Mesh Certificate based provisioning.

Question

So basically, I am have created a key pair using the Identity key generation example and exported the public key using Identity key usage example. Now i need to create a certificate signing request, so I am trying to follow the PSA Crypto example to do the same. But it is not building as I facing the following error: 
 <command-line>: fatal error: user-tls-conf.h: No such file or directory 
 please help me with the same

Sigurd Hellesvik · Accepted Answer

This one looks like it works for the nRF5340DK, without TF-M. https://github.com/hellesvik-nordic/samples_for_nrf_connect_sdk/tree/main/crypto/psa_csr 
 I did not check the output, so that would be for you. 
 Can you give the sample a roll and let me know how it goes? 
 EDIT: I was told that ECC would be a better idea than RSA here so I will change it relatively soon

Utkarsh · Answer

Thank you very much for adding TF-M support! 
 Is there a reason why patch was required and not included in the NCS release?

Sigurd Hellesvik · Answer

Utkarsh said: Thank you very much for adding TF-M support! 
 The sample itself does not support TF-M. But the patch from before was breaking TF-M globally so I fixed that. 
 Utkarsh said: Is there a reason why patch was required and not included in the NCS release? 
 We are currently working on converting our crypto libraries, and not everything has been moved yet. This will be added to NCS at some point, but in the meantime I created a patch as a workaround. The patch is not "clean", so the final solution at some later point will probably be different.

Sigurd Hellesvik · Answer

I had a bug in my patch, which by chance caused this very random error. I fixed it in a commit now

Sigurd Hellesvik · Answer

Utkarsh said: The above mentioned error is thrown when I assign life time as PSA_KEY_LIFETIME_PERSISTENT instead of PSA_KEY_LIFETIME_VOLATILE and use psa_set_key_id 
 Yes in the case of persistent lifetime you will need to enable some more settings. 
 Utkarsh said: One final question, how can I add TF-M support ? 
 Our TF-M implementation does not support CSR yet, so this sample will not work with TF-M in v2.7.0. I specifically asked our devs about this when I created the sample. 
 I cannot give any timeline as to when our TF-M implementation will support this.

Trouble creating a create a certificate signing request on nrf5340 for BLE Mesh Certificate based provisioning.

Top Replies