TC-DA-1.7 failing and requires different Authority Key Identifier from the PAI certificate for testing

[BilalAliAhmad]

[MatterTest] 09-25 08:50:35.568 INFO ***** Test Step 2.3 : TH extracts the Authority Key Identifier from the PAI certificate
[MatterTest] 09-25 08:50:35.568 INFO ***** Test Step 2.3 : TH extracts the Authority Key Identifier from the PAI certificate
[MatterTest] 09-25 08:50:35.569 INFO DUT 2 Step 3 check 1: Ensure PAI's AKID matches a PAA and signature is valid
[MatterTest] 09-25 08:50:35.569 INFO Matched PAA file Chip-PAA-Cert.der, subject: <Name(CN=Matter Development PAA 01,1.3.6.1.4.1.37244.2.1=1568)>
[MatterTest] 09-25 08:50:35.570 INFO Validated PAI signature against PAA
[MatterTest] 09-25 08:50:35.571 INFO DUT 2 Step 3 check 2: Verify PAI AKID not in denylist of SDK PAIs
[MatterTest] 09-25 08:50:35.571 INFO ***** Test Step 2.4 : TH extracts ASN.1 DER bytes for the entire issuer field of `dac_cert` and subject field of `pai_cert`.
[MatterTest] 09-25 08:50:35.572 INFO ***** Test Step 2.4 : TH extracts ASN.1 DER bytes for the entire issuer field of `dac_cert` and subject field of `pai_cert`.
[MatterTest] 09-25 08:50:35.572 INFO ***** Test Step 2.5 : TH extracts ASN.1 DER bytes for the entire issuer field of `pai_cert` and subject field of `paa_cert`.
[MatterTest] 09-25 08:50:35.573 INFO ***** Test Step 2.5 : TH extracts ASN.1 DER bytes for the entire issuer field of `pai_cert` and subject field of `paa_cert`.
[MatterTest] 09-25 08:50:35.573 INFO ***** Test Step 2.6 : TH extracts the public key from the DAC and saves as `pk_2`.
[MatterTest] 09-25 08:50:35.574 INFO ***** Test Step 2.6 : TH extracts the public key from the DAC and saves as `pk_2`.
[MatterTest] 09-25 08:50:35.574 INFO Subject public key pk: 04f848099562c49204e8361b57f245f8b73ea7dc3e3c51b8625f882c1a9e58770c57c3a23b9eac9d78ba87a6fb28ac53d946a00d962e61e298d88b270451f5a9e9
[MatterTest] 09-25 08:50:35.577 INFO ***** Test Step 3 : Verify that `pk_1` is not equal to `pk_2
[MatterTest] 09-25 08:50:35.577 INFO ***** Test Step 3 : Verify that `pk_1` is not equal to `pk_2
[MatterTest] 09-25 08:50:35.578 ERROR Exception occurred in test_TC_DA_1_7.
Traceback (most recent call last):
File "/usr/local/lib/python3.12/dist-packages/mobly/base_test.py", line 818, in exec_one_test
test_method()
File "/root/python_testing/scripts/sdk/matter_testing_support.py", line 2134, in async_runner
return _async_runner(body, self, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/root/python_testing/scripts/sdk/matter_testing_support.py", line 2122, in _async_runner
return asyncio.run(runner_with_timeout)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/asyncio/runners.py", line 194, in run
return runner.run(main)
^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/asyncio/runners.py", line 118, in run
return self._loop.run_until_complete(task)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/asyncio/base_events.py", line 687, in run_until_complete
return future.result()
^^^^^^^^^^^^^^^
File "/usr/lib/python3.12/asyncio/tasks.py", line 520, in wait_for
return await fut
^^^^^^^^^
File "/root/python_testing/scripts/sdk/TC_DA_1_7.py", line 186, in test_TC_DA_1_7
asserts.assert_equal(len(pk), len(set(pk)), "Found matching public keys in different DUTs")
File "/usr/local/lib/python3.12/dist-packages/mobly/asserts.py", line 66, in assert_equal
_call_unittest_assertion(
File "/usr/local/lib/python3.12/dist-packages/mobly/asserts.py", line 50, in _call_unittest_assertion
raise signals.TestFailure(my_msg, extras=extras)
mobly.signals.TestFailure: Details=2 != 1 Found matching public keys in different DUTs, Extras=None
[MatterTest] 09-25 08:50:35.589 INFO ***** Test Failure :
[MatterTest] 09-25 08:50:35.589 INFO Finished test in 2936246.0ms

How to generate unique keys for different devices using same certs:

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT="C:/Econet-gatelock-matter/certs/Chip-DAC-Cert.der"

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY="C:/Econet-gatelock-matter/certs/Chip-DAC-Key.der"

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT="C:/Econet-gatelock-matter/certs/Chip-PAI-Cert.der"

We have used unique for all devices: 

CONFIG_CHIP_DEVICE_DISCRIMINATOR=0xF00

CONFIG_CHIP_DEVICE_SPAKE2_PASSCODE=20202021

[Marte Myrvold]

Hi,

The error indicates that all your devices use the same DAC and private key.

You can use the CHIP Certificate Tool to generate unique DACs for each device with the gen-att-cert command:

./chip-cert gen-att-cert \
  --type d \
  --subject-cn "Matter Development DAC <serial>" \
  --subject-vid <VID> \
  --subject-pid <PID> \
  --valid-from "YYYY-MM-DD HH:MM:SS" \
  --lifetime 7305 \
  --ca-key Chip-PAI-Key.pem \
  --ca-cert Chip-PAI-Cert.pem \
  --out-key Chip-DAC-Key-<serial>.pem \
  --out Chip-DAC-Cert-<serial>.pem

Replace <serial> with a unique identifier for each device.

After you have generated DACs, you can convert the generated PEM files to DER format if needed using the convert-cert and convert-key commands:

./chip-cert convert-cert -d Chip-DAC-Cert-<serial>.pem Chip-DAC-Cert-<serial>.der

./chip-cert convert-key -d Chip-DAC-Key-<serial>.pem Chip-DAC-Key-<serial>.der

Best regards,
Marte

[BilalAliAhmad]

Hi Marte Myrvold we are using configs to build factory data. Can we use settings like this to generate unique data for at least two device required for testing:

CONFIG_CHIP=y

CONFIG_CHIP_DEVICE_VENDOR_ID=1233

CONFIG_CHIP_DEVICE_VENDOR_NAME="vedorInc"

CONFIG_CHIP_DEVICE_PRODUCT_ID=3

CONFIG_CHIP_DEVICE_PRODUCT_NAME="device"

CONFIG_CHIP_DEVICE_HARDWARE_VERSION=0

CONFIG_CHIP_DEVICE_HARDWARE_VERSION_STRING="prerelease"

CONFIG_CHIP_DEVICE_SOFTWARE_VERSION=0

CONFIG_CHIP_DEVICE_SOFTWARE_VERSION_STRING="prerelease"

CONFIG_CHIP_DEVICE_MANUFACTURING_DATE="2025-05-15"

CONFIG_CHIP_DEVICE_SERIAL_NUMBER="11223344556677889900"

CONFIG_CHIP_DEVICE_ROTATING_DEVICE_UID="592f5a8aaaa8615def3d9eaaba0a67ae"

CONFIG_CHIP_ROTATING_DEVICE_ID=n

CONFIG_CHIP_DEVICE_TYPE=10

CONFIG_CHIP_DEVICE_DISCRIMINATOR=0xF00

CONFIG_CHIP_DEVICE_SPAKE2_PASSCODE=20202021

CONFIG_CHIP_DEVICE_SPAKE2_IT=1000

CONFIG_CHIP_DEVICE_SPAKE2_SALT="U1BBS0UyUCBLZXkgU2FsdA=="

CONFIG_CHIP_DEVICE_SPAKE2_TEST_VERIFIER="uWFwqugDNGiEck/po7KHwwMwwqZgN10XuyBajPGuyzUEV/iree4lOrao5GuwnlQ65CJzbeUB49s31EH+NEkg0JVI5MGCQGMMT/SRPFNRODm3wH/MBiehuFc6FJ/NH6Rmzw=="

CONFIG_CHIP_DEVICE_ENABLE_KEY="00112233445566778899AABBCCDDEEFF"

CONFIG_CHIP_DEVICE_PRODUCT_FINISH="other"

CONFIG_CHIP_ENABLE_PAIRING_AUTOSTART=n

CONFIG_CHIP_OPERATIONAL_TIME_SAVE_INTERVAL=10

CONFIG_CHIP_PROJECT_CONFIG="src/chip_project_config.h"

#CONFIG_CHIP_FACTORY_RESET_ERASE_SETTINGS =y

CONFIG_CHIP_FACTORY_DATA=y

CONFIG_CHIP_FACTORY_DATA_BUILD=y

CONFIG_CHIP_FACTORY_DATA_MERGE_WITH_FIRMWARE=y

CONFIG_CHIP_FACTORY_DATA_USE_DEFAULT_CERTS=n

CONFIG_CHIP_FACTORY_DATA_GENERATE_ONBOARDING_CODES=y

CONFIG_CHIP_FACTORY_DATA_CERT_SOURCE_USER=y

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT="C:/Econet-gatelock-matter/certs/Chip-DAC-Cert.der"

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY="C:/Econet-gatelock-matter/certs/Chip-DAC-Key.der"

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT="C:/Econet-gatelock-matter/certs/Chip-PAI-Cert.der"

Additionally do we need a unique CD for every device and store it into 

CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION inside src\chip_project_config.h file? 

[Marte Myrvold]

Hi,

You still need to use the CHIP certificate tool to generate the certificates themselves, then include the certificates in prj.conf with

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT=".../Chip-DAC-Cert-<serial>.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY=".../Chip-DAC-Key-<serial>.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT=".../Chip-PAI-Cert.der"

Replace ... with the actual path to the certificates.

Best regards,
Marte

[BilalAliAhmad]

Hi,

will all these three will be unique or only DAC key and DAC cert will be unique per device?

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT=".../Chip-DAC-Cert-<serial>.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY=".../Chip-DAC-Key-<serial>.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT=".../Chip-PAI-Cert.der"

Additionally do we need a unique CD for every device and store it into 

CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION inside src\chip_project_config.h file? 

[Marte Myrvold]

Hi,

Only the DAC key and cert will be unique. Make sure to replace <serial> with the unique identifier for the device, both when generating the certificates and in the Kconfig options in prj.conf.

BilalAliAhmad said:

Additionally do we need a unique CD for every device and store it into 

CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION inside src\chip_project_config.h file? 

No, the CD does not need to be unique for each device. 

Best regards,
Marte