Hello, I started working with the nRF Cloud and have been trying to understand the authentication procedure.
From my understanding, the create_credentials script creates the private and public key, and the CA.
This is CA, which is then used to sign the device certificate. In the end the sec_tag has three types of data:
type 0: the Amazon CA - used by the device to authenticate the server.
type 1: our device certificate - used by the server to authenticate the device when using MQTT and MTLS.
type 3: our private key that signs the JWT token, its public key pair is inside the certificate that is inside the onboard.csv file that we upload.
I have a few questions:
1. I understand that our device certificate is used in the MTLS for the server to trust the device, but I don't understand why a device certificate that is signed by a CA that I created with a simple script is what does the trick. In other words, why am I a trusted authority? What security problem does this solve?
Furthermore, when I checked the onboard.csv contents, I saw that the CA public key isn't present, only the device credentials that are flashed in type 1 of the sectag, which means that the device certificate contents isn't even verified. The authentication in this case is only that the server sees that the device certificate is the same one that was uploaded to it? why then did we need a device certificate that is signed with a private key if it isnt even used?
2. chating with Claude, he said something about the type 1 being used for some kind of JITP but I couldnt find any documentation for that, is that true?
thanks in advance,
shlomo
