nrf9160: Adding intermediate certificates to the TLS engine

[Cody]

Hello,

I am running into an issue attempting to add certificates to the device in order to facilitate HTTPS calls to our backend directly from the device.

Before the LTE modem has been configured I make a call to nrf_inbuilt_key_write in order to write the private/public and CA certifications to the device.

 

I appear to be running into a limitation with the certificate size when passing it to nrf_inbuilt_key_write. If the certificate size is too large, it will return me error 105 (NRF_ENOBUFS).

The reason that the certificate is so large is that it contains the root certificate authority as well as an additional intermediate certificate.

Is there any solution to installing more than one (intermediate) CA certificates to the device?

Thank you

[Hakon]

Hello,

if you want to write multiple certificates to the modem you can write them to different tags. Change the sec_tag argument in nrf_inbuilt_key_write() to something new. Be careful not to overwrite other certificates in the modem. You want to avoid writing to existing tags like for instance 16842753, which is being used by nrf_cloud certificates.

[Cody]

Hakon,

I was able to test writing public, private, and the CA certificate to one security tag, and then the intermediate CA certificate to another security tag and adding both security tags to the sec_tag_list when calling setsockopt.

This was unsuccessful.

Also, in case you were wondering, I do have HTTPS working if I use a different combination of the public, private, and CA certificate for a different URL so I know it does work, just need to get it working when there is more than one CA certificate (intermediate certificates).

[Heidi]

Hi, Håkon is on vacation so I took over this case. 

I don't think you need to include all the CA certificates in the chain, as long as the root-certificate is approved and all the other certificates are signed. Have you tried not including the additional intermediate certificate?

Side note: we don't recommend writing certificates from the application. 

Best regards,

Heidi

[Cody]

I will try this now.

[Cody]

Hey Heidi,

It doesn't appear to be working. I used openssl to verify that my private key does indeed match my public certificate using the instructions here: https://support.comodo.com/index.php?/Knowledgebase/Article/View/684/17/how-do-i-verify-that-a-private-key-matches-a-certificate-openssl

When I run openssl s_client -showcerts -connect hostname:443 it shows me three different certificates in the chain.

Also, if you don't recommend writing the certificates from the application is there a preferred methodology?

Thanks

[Heidi]

Hi, there are unfortunately maximum sizes, see here. 

In release v1.1 of NCS the maximum size for one certificate is 4 kB, the maximum amount of intermediate certificates is 4 and the total flash size reserved for certificates is 7 x 8 kB. The chain file for certificate chaining must be less than 8kB.

You could try using RSA 2048 keys or by using Elliptical Curve keys which are smaller than RSA.

The developers have also confirmed that using two separate tags for two certificates chained together is not supported but could be in the future. You can contact your regional sales manager to ask for more information. 

[Cody]

Okay, so it sounds like if I have a certificate chain consisting of 3 certificates (which is less than the maximum amount of 4 intermediate certificates) but exceeds 4kB when put all together, this configuration is not supported for now?

I guess I am just confused by what you mean when you say, "The chain file for certificate chaining must be less than 8kB." The three certificates that I need to add to the modem is just slightly over 6kB and all of them are well under 4 kB individually.

Can you confirm that this scenario (3 certificates, all under 4kB individually, over 6kB when combined) is unsupported? Note that I am not included the public/private key in this scenario.

[Heidi]

The chain file is the ordered list of all certificates. If you're sure it's under 8kB I'll double-check with the developers again.

Could you run AT%CMNG=1 to list all storage certificates and keys?