TC-DA-1.7 failing and requires different Authority Key Identifier from the PAI certificate for testing

RE: TC-DA-1.7 failing and requires different Authority Key Identifier from the PAI certificate for testing

Marte Myrvold — Thu, 02 Oct 2025 08:25:17 GMT

Hi,

Only the DAC key and cert will be unique. Make sure to replace <serial> with the unique identifier for the device, both when generating the certificates and in the Kconfig options in prj.conf.

[quote user="BilalAliAhmad"]

Additionally do we need a unique CD for every device and store it into

CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION inside src\chip_project_config.h file?

[/quote]

No, the CD does not need to be unique for each device.

Best regards,
Marte

RE: TC-DA-1.7 failing and requires different Authority Key Identifier from the PAI certificate for testing

BilalAliAhmad — Wed, 01 Oct 2025 13:20:03 GMT

Hi,

will all these three will be unique or only DAC key and DAC cert will be unique per device?

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT=".../Chip-DAC-Cert-<serial>.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY=".../Chip-DAC-Key-<serial>.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT=".../Chip-PAI-Cert.der"

Additionally do we need a unique CD for every device and store it into

CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION inside src\chip_project_config.h file?

RE: TC-DA-1.7 failing and requires different Authority Key Identifier from the PAI certificate for testing

Marte Myrvold — Wed, 01 Oct 2025 13:16:37 GMT

Hi,

You still need to use the CHIP certificate tool to generate the certificates themselves, then include the certificates in prj.conf with

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT=".../Chip-DAC-Cert-<serial>.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY=".../Chip-DAC-Key-<serial>.der"
CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT=".../Chip-PAI-Cert.der"

Replace ... with the actual path to the certificates.

Best regards,
Marte

RE: TC-DA-1.7 failing and requires different Authority Key Identifier from the PAI certificate for testing

BilalAliAhmad — Wed, 01 Oct 2025 12:00:22 GMT

Hi Marte Myrvold we are using configs to build factory data. Can we use settings like this to generate unique data for at least two device required for testing:

CONFIG_CHIP=y

CONFIG_CHIP_DEVICE_VENDOR_ID=1233

CONFIG_CHIP_DEVICE_VENDOR_NAME="vedorInc"

CONFIG_CHIP_DEVICE_PRODUCT_ID=3

CONFIG_CHIP_DEVICE_PRODUCT_NAME="device"

CONFIG_CHIP_DEVICE_HARDWARE_VERSION=0

CONFIG_CHIP_DEVICE_HARDWARE_VERSION_STRING="prerelease"

CONFIG_CHIP_DEVICE_SOFTWARE_VERSION=0

CONFIG_CHIP_DEVICE_SOFTWARE_VERSION_STRING="prerelease"

CONFIG_CHIP_DEVICE_MANUFACTURING_DATE="2025-05-15"

CONFIG_CHIP_DEVICE_SERIAL_NUMBER="11223344556677889900"

CONFIG_CHIP_DEVICE_ROTATING_DEVICE_UID="592f5a8aaaa8615def3d9eaaba0a67ae"

CONFIG_CHIP_ROTATING_DEVICE_ID=n

CONFIG_CHIP_DEVICE_TYPE=10

CONFIG_CHIP_DEVICE_DISCRIMINATOR=0xF00

CONFIG_CHIP_DEVICE_SPAKE2_PASSCODE=20202021

CONFIG_CHIP_DEVICE_SPAKE2_IT=1000

CONFIG_CHIP_DEVICE_SPAKE2_SALT="U1BBS0UyUCBLZXkgU2FsdA=="

CONFIG_CHIP_DEVICE_SPAKE2_TEST_VERIFIER="uWFwqugDNGiEck/po7KHwwMwwqZgN10XuyBajPGuyzUEV/iree4lOrao5GuwnlQ65CJzbeUB49s31EH+NEkg0JVI5MGCQGMMT/SRPFNRODm3wH/MBiehuFc6FJ/NH6Rmzw=="

CONFIG_CHIP_DEVICE_ENABLE_KEY="00112233445566778899AABBCCDDEEFF"

CONFIG_CHIP_DEVICE_PRODUCT_FINISH="other"

CONFIG_CHIP_ENABLE_PAIRING_AUTOSTART=n

CONFIG_CHIP_OPERATIONAL_TIME_SAVE_INTERVAL=10

CONFIG_CHIP_PROJECT_CONFIG="src/chip_project_config.h"

#CONFIG_CHIP_FACTORY_RESET_ERASE_SETTINGS =y

CONFIG_CHIP_FACTORY_DATA=y

CONFIG_CHIP_FACTORY_DATA_BUILD=y

CONFIG_CHIP_FACTORY_DATA_MERGE_WITH_FIRMWARE=y

CONFIG_CHIP_FACTORY_DATA_USE_DEFAULT_CERTS=n

CONFIG_CHIP_FACTORY_DATA_GENERATE_ONBOARDING_CODES=y

CONFIG_CHIP_FACTORY_DATA_CERT_SOURCE_USER=y

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_CERT="C:/Econet-gatelock-matter/certs/Chip-DAC-Cert.der"

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_DAC_KEY="C:/Econet-gatelock-matter/certs/Chip-DAC-Key.der"

CONFIG_CHIP_FACTORY_DATA_USER_CERTS_PAI_CERT="C:/Econet-gatelock-matter/certs/Chip-PAI-Cert.der"

Additionally do we need a unique CD for every device and store it into

CHIP_DEVICE_CONFIG_CERTIFICATION_DECLARATION inside src\chip_project_config.h file?

RE: TC-DA-1.7 failing and requires different Authority Key Identifier from the PAI certificate for testing

Marte Myrvold — Wed, 01 Oct 2025 11:55:23 GMT

Hi,

The error indicates that all your devices use the same DAC and private key.

You can use the CHIP Certificate Tool to generate unique DACs for each device with the gen-att-cert command:

./chip-cert gen-att-cert \
  --type d \
  --subject-cn "Matter Development DAC <serial>" \
  --subject-vid <VID> \
  --subject-pid <PID> \
  --valid-from "YYYY-MM-DD HH:MM:SS" \
  --lifetime 7305 \
  --ca-key Chip-PAI-Key.pem \
  --ca-cert Chip-PAI-Cert.pem \
  --out-key Chip-DAC-Key-<serial>.pem \
  --out Chip-DAC-Cert-<serial>.pem

Replace <serial> with a unique identifier for each device.

After you have generated DACs, you can convert the generated PEM files to DER format if needed using the convert-cert and convert-key commands:

./chip-cert convert-cert -d Chip-DAC-Cert-<serial>.pem Chip-DAC-Cert-<serial>.der

./chip-cert convert-key -d Chip-DAC-Key-<serial>.pem Chip-DAC-Key-<serial>.der

Best regards,
Marte