JITP 证书不是使用 mbedTLS+ATECC608A 创建的（适用于 moquitto_pub）

Question

我有以下设置：

ATECC608A
mbedTLS（使用 2.16.6 和 2.16.9 测试）
coreMQTT 证书链如下：RootCA > SignerCA > DeviceCert。我已在 AWS IoT 控制台中将 RootCA 和 SignerCA 都注册为 CA

我在 mbedTLS 中使用以下内容设置链：

/* Extract the device certificate and convert to mbedtls cert */
if (0 != atca_mbedtls_cert_add(&device_cert_chain, &g_cert_def_2_device))
{
    printf("Failed to parse device cert from device\n");
    goto exit;
}

/* Extract the signer certificate, convert, then attach to the chain */
if (0 != atca_mbedtls_cert_add(&device_cert_chain, &g_cert_def_1_signer))
{
    printf("Failed to parse signer cert from device\n");
    goto exit;
}

当使用该堆栈连接到我的 ats 端点时，TLS 握手成功：提供了设备证书和 signerCA，AWS 也提供了它的证书链。 mbedTLS 似乎很高兴：

....[SNIP]
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:2898: <= parse server hello done
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3522: client state: 7
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2765: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5343: => write certificate
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: own certificate #1:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: cert. version     : 3
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: serial number     : 40:F7:D9:46:59:6E:2F:58:E6:87:04:4F:D5:6E:86:03
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issuer name       : O=CompanyName, CN=signer.companyname.com FFFF
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: subject name      : O=CompanyName, CN=pu0223528E47B3461DEE
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issued  on        : 2021-01-14 21:00:00
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: expires on        : 3000-12-31 23:59:59
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: signed using      : ECDSA with SHA256
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: EC key size       : 256 bits
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: basic constraints : CA=false
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: key usage         : Digital Signature, Key Agreement
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(X)' (256 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  c7 1f a4 ea e7 ae 51 16 fb c3 0b ce 33 f1 7a af
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  f1 27 3a af a7 5d 76 76 74 58 e8 56 36 94 56 76
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(Y)' (255 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  5f a6 2e 21 53 a5 91 7d 95 f8 9e 0e f8 ce bd d9
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  c1 50 83 c2 7d 74 98 4b 66 b2 eb 9a b7 49 48 4c
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: own certificate #2:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: cert. version     : 3
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: serial number     : 4D:29:66:FF:B8:09:8D:39:0E:39:C8:3A:94:6E:EE:6A
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issuer name       : O=CompanyName, CN=root.companyname.com FFFF
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: subject name      : O=CompanyName, CN=signer.companyname.com FFFF
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: issued  on        : 2020-11-09 17:55:11
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: expires on        : 2070-10-28 17:44:12
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: signed using      : ECDSA with SHA256
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: EC key size       : 256 bits
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: basic constraints : CA=true
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: key usage         : Digital Signature, Key Cert Sign, CRL Sign
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(X)' (256 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  cc 63 87 d3 bd 58 08 1e c7 55 02 be a8 e1 d7 a2
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  f9 7f 62 0a 39 c6 40 45 cf 1d 83 4a 53 5e 6a e3
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395: value of 'crt->eckey.Q(Y)' (255 bits) is:
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  5b be ad 83 96 10 3c 0e 5b 0b 60 32 65 5d d3 3b
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5395:  77 90 b2 a7 a8 cb 90 b7 49 3f 24 cd c6 6b 1f 38
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3192: => write handshake message
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3351: => write record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3428: output record: msgtype = 22, version = [3:3], msglen = 982
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: dumping 'output record sent to network' (987 bytes)

....[SNIP]
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4399: <= read record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6606: <= parse finished
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3522: client state: 14
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2765: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3633: handshake: done
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_cli.c:3522: client state: 15
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2765: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6350: => handshake wrapup
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6323: => handshake wrapup: final free
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6343: <= handshake wrapup: final free
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:6405: <= handshake wrapup
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8108: <= handshake
 ok
TLS Session Established and a Socket is ready for an Application

然后我使用创建的 mbedtls_ssl_context 连接 coreMQTT。从日志中，coreMQTT 能够在套接字上写入，但 AWS 关闭了连接。

...[SNIP]...
TLS Session Established and a Socket is ready for an Application
Initializing MQTT...ok
Connecting to the MQTT broker with params:
- identifier='testclient'
- username='?SDK=Fedora&Version=33&Platform=PC&MQTTLib=core-mqtt@v1.1.0'
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8696: => write
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3351: => write record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1443: => encrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: dumping 'before encrypt: output payload' (85 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0000:  10 53 00 04 4d 51 54 54 04 82 00 3c 00 0a 74 65  .S..MQTT...<..te
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0010:  73 74 63 6c 69 65 6e 74 00 3b 3f 53 44 4b 3d 46  stclient.;?SDK=F
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0020:  65 64 6f 72 61 26 56 65 72 73 69 6f 6e 3d 33 33  edora&Version=33
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0030:  26 50 6c 61 74 66 6f 72 6d 3d 50 43 26 4d 51 54  &Platform=PC&MQT
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0040:  54 4c 69 62 3d 63 6f 72 65 2d 6d 71 74 74 40 76  TLib=core-mqtt@v
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1453: 0050:  31 2e 31 2e 30                                   1.1.0
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1572: dumping 'additional data for AEAD' (13 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1572: 0000:  00 00 00 00 00 00 00 01 17 03 03 00 55           ............U
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1602: dumping 'IV used (internal)' (12 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1602: 0000:  91 d1 a1 52 00 00 00 00 00 00 00 01              ...R........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1604: dumping 'IV used (transmitted)' (8 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1604: 0000:  00 00 00 00 00 00 00 01                          ........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1614: before encrypt: msglen = 93, including 0 bytes of padding
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1641: dumping 'after encrypt: tag' (16 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1641: 0000:  db 24 89 b1 5f 7f e6 ff 78 dd c3 8b 34 99 79 1f  .$.._...x...4.y.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1779: <= encrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3428: output record: msgtype = 23, version = [3:3], msglen = 109
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: dumping 'output record sent to network' (114 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0000:  17 03 03 00 6d 00 00 00 00 00 00 00 01 ba 08 e9  ....m...........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0010:  fb f4 64 84 4e 6d 31 6e 89 3f 7b 74 e1 9a 0a af  ..d.Nm1n.?{t....
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0020:  82 33 4e 7b 13 23 de ba 55 19 41 24 6e 95 14 3c  .3N{.#..U.A$n..<
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0030:  2a 6e 02 67 6d 76 4d f8 32 a0 45 ca 12 a2 1a 31  *n.gmvM.2.E....1
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0040:  97 26 45 13 88 07 2c 18 13 ab 92 4b 2b 98 41 49  .&E...,....K+.AI
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0050:  03 5a 4f a9 5d 95 33 2b 68 c9 16 ee 2a ad 59 0a  .ZO.].3+h...*.Y.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0060:  7a 52 db 24 89 b1 5f 7f e6 ff 78 dd c3 8b 34 99  zR.$.._...x...4.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3433: 0070:  79 1f                                            y.
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2753: => flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2771: message length: 114, out_left: 114
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2777: ssl->f_send() returned 114 (-0xffffff8e)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2805: <= flush output
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:3484: <= write record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8724: <= write
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8284: => read
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4325: => read record
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2534: => fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2694: in_left: 0, nb_want: 5
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2718: in_left: 0, nb_want: 5
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2720: ssl->f_recv(_timeout)() returned 5 (-0xfffffffb)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2740: <= fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4061: dumping 'input record header' (5 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4061: 0000:  15 03 03 00 1a                                   .....
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4067: input record: msgtype = 21, version = [3:3], msglen = 26
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2534: => fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2694: in_left: 5, nb_want: 31
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2718: in_left: 5, nb_want: 31
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2720: ssl->f_recv(_timeout)() returned 26 (-0xffffffe6)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2740: <= fetch input
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4246: dumping 'input record from network' (31 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4246: 0000:  15 03 03 00 1a 00 00 00 00 00 00 00 01 33 90 3f  .............3.?
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4246: 0010:  df 0b 29 53 90 20 f1 90 14 82 84 99 e9 f6 db     ..)S. .........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1792: => decrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1879: dumping 'additional data for AEAD' (13 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1879: 0000:  00 00 00 00 00 00 00 01 15 03 03 00 02           .............
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1908: dumping 'IV used' (12 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1908: 0000:  3a e9 5a f2 00 00 00 00 00 00 00 01              :.Z.........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1909: dumping 'TAG used' (16 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:1909: 0000:  3f df 0b 29 53 90 20 f1 90 14 82 84 99 e9 f6 db  ?..)S. .........
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:2374: <= decrypt buf
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4273: dumping 'input payload after decrypt' (2 bytes)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4273: 0000:  01 00                                            ..
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5183: got an alert message, type: [1:0]
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:5199: is a close notify message
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:4383: mbedtls_ssl_handle_message_type() returned -30848 (-0x7880)
mbedtls-examples/cryptoauthlib/third_party/mbedtls/library/ssl_tls.c:8349: mbedtls_ssl_read_record() returned -30848 (-0x7880)

我预计第一个连接会失败。但在这种情况下，证书不会出现在 AWS IoT 控制台中，后续连接尝试也会失败。

我仔细检查了存储的 signerCA 及其策略。他们看起来很好。为了确保此配置正确，我在我的机器上手动创建了一个证书并使用我的 SignerCA.I 对其进行了签名，然后将该证书与 mosquitto_pub 一起使用。该过程有效，我的证书出现在 AWS IoT 控制台中，并附加了正确的策略。这是我正在做的事情的日志：

$ openssl genpkey -out fakeDeviceCert.key -algorithm EC -pkeyopt ec_paramgen_curve:P-256
$ openssl req -new -key fakeDeviceCert.key -out fakeDeviceCert.csr
$ openssl x509 -req -in fakeDeviceCert.csr -CA ../certs/signer-FFFF.crt \
   -CAkey ../certs/signer-FFFF.key \
   -CAcreateserial \
  -out fakeDeviceCert.pem \
  -days 357335 \
  -sha256
$ cat fakeDeviceCert.pem ../certs/signer-FFFF.crt > deviceCertAndCACert.crt
$ mosquitto_pub --cafile AmazonRootCA1.pem \
    --cert deviceCertAndCACertcrt --key fakeDeviceCert.key \
    -h <redacted>-ats.iot.eu-central-1.amazonaws.com  -p 8883 -q 1 -t  ji/tp \
    -i  deviceCert --tls-version tlsv1.2 -m '{"let-me": "in"}' -d

这样做，我知道附加到我的 signerCA 的策略是正确的并且运行很好。

我所做的另一个验证是检查我的 coreMQTT 连接是否正确。为了在没有 JITP 配置的情况下进行连接，我从 ATECC 提取了设备证书，手动上传了它的 PEM 并在 AWS 控制台中将策略附加到设备。 MQTT 连接成功（我在 AWS 日志中看到了 'MQTT.Connect 事件）。

这是相关的证书说明。我已经从输出中编辑了 Issuer/Subject，因此签名不正确：

存储在 ATECC 中的设备证书（不触发配置过程的证书）：

$ openssl x509 -text -noout -in extracted_device_cert.pm
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            40:f7:d9:46:59:6e:2f:58:e6:87:04:4f:d5:6e:86:03
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: O = CompanyName, CN = signer.companyname.com FFFF
        Validity
            Not Before: Jan 14 21:00:00 2021 GMT
            Not After : Dec 31 23:59:59 3000 GMT
        Subject: O = CompanyName, CN = pu0223528E47B3461DEE
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:c7:1f:a4:ea:e7:ae:51:16:fb:c3:0b:ce:33:f1:
                    7a:af:f1:27:3a:af:a7:5d:76:76:74:58:e8:56:36:
                    94:56:76:5f:a6:2e:21:53:a5:91:7d:95:f8:9e:0e:
                    f8:ce:bd:d9:c1:50:83:c2:7d:74:98:4b:66:b2:eb:
                    9a:b7:49:48:4c
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature, Key Agreement
            X509v3 Subject Key Identifier: 
                4A:F0:38:0D:8E:57:76:71:A2:92:07:B7:60:1B:C7:0A:B4:7E:8B:D1
            X509v3 Authority Key Identifier: 
                keyid:4C:E5:14:B2:9D:3E:8F:29:43:34:45:83:34:C2:F4:09:53:60:13:99

    Signature Algorithm: ecdsa-with-SHA256
         30:44:02:20:5c:86:11:4b:79:07:ce:34:32:61:6d:00:2a:7c:
         43:75:16:e9:b6:ae:13:21:91:25:5f:1b:80:c3:b2:41:93:0d:
         02:20:31:fc:4c:6d:5e:f0:54:46:da:ae:d7:aa:b7:f8:6a:c8:
         21:ba:45:62:31:7b:55:f7:b3:38:af:7c:97:25:81:72

以及正确触发 JITP 的手动生成的证书：

$ openssl x509 -text -noout -in fakeDeviceCert.pem 
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            7a:50:78:20:5e:dc:de:56:74:55:fb:fa:6e:61:ed:13:ed:c9:0a:b7
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: O = CompanyName, CN = signer.companyname.com FFFF
        Validity
            Not Before: Jan 15 08:22:44 2021 GMT
            Not After : May 23 08:22:44 2999 GMT
        Subject: O = CompanyName, CN = pu010203040506070811
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:62:1e:35:5a:97:ec:7f:f7:82:6e:67:7a:ac:a5:
                    1b:b0:a3:bc:42:08:cb:0e:fe:ad:07:46:0c:dd:8c:
                    ca:b3:60:8f:e3:0b:59:a4:b3:e5:6b:a5:22:8e:49:
                    d3:3a:1e:76:43:7b:7a:cd:dd:0d:dc:52:1f:8f:83:
                    ee:10:e0:fb:1a
                ASN1 OID: prime256v1
                NIST CURVE: P-256
    Signature Algorithm: ecdsa-with-SHA256
         30:46:02:21:00:8f:3a:b4:e4:25:98:3c:79:23:65:e4:1b:68:
         75:19:11:27:91:df:66:22:ea:c1:13:06:72:6f:e0:5d:3d:13:
         49:02:21:00:e2:7e:2b:92:55:68:98:09:b9:a4:e9:7b:2a:7c:
         48:2a:bb:23:c7:45:d2:96:ec:df:9b:62:a8:9d:7a:98:06:fe

这是来自 AWS 的 signerCA 描述（在 <> 之间有一些编辑字段）

$ aws iot describe-ca-certificate --certificate-id <my-ca-cert-id>
{
    "certificateDescription": {
        "certificateArn": "arn:aws:iot:eu-central-1:<accountID>:cacert/<ca-id>",
        "certificateId": "<ca-id>",
        "status": "ACTIVE",
        "certificatePem": "-----BEGIN CERTIFICATE-----\n<pem-content>-----END CERTIFICATE-----\n",
        "ownedBy": "<owner-account-id>",
        "creationDate": "2021-01-11T10:40:58.736000+01:00",
        "autoRegistrationStatus": "ENABLE",
        "lastModifiedDate": "2021-01-14T23:38:52.132000+01:00",
        "customerVersion": 2,
        "generationId": "09eb8608-630c-4632-a1ef-0879f6f2dd6f",
        "validity": {
            "notBefore": "2020-11-09T18:55:11+01:00",
            "notAfter": "2070-10-28T18:44:12+01:00"
        }
    },
    "registrationConfig": {
        "templateBody": "{\"Parameters\": {\"AWS::IoT::Certificate::CommonName\": {\"Type\": \"String\"}, \"AWS::IoT::Certificate::Id\": {\"Type\": \"String\"}}, \"Resources\": {\"thing\": {\"Type\": \"AWS::IoT::Thing\", \"Properties\": {\"ThingName\": {\"Ref\": \"AWS::IoT::Certificate::CommonName\"}, \"AttributePayload\": {\"version\": \"v1\"}}}, \"certificate\": {\"Type\": \"AWS::IoT::Certificate\", \"Properties\": {\"CertificateId\": {\"Ref\": \"AWS::IoT::Certificate::Id\"}, \"Status\": \"ACTIVE\"}}, \"policy\": {\"Type\": \"AWS::IoT::Policy\", \"Properties\": {\"PolicyDocument\": \"{\\"Version\\": \\"2012-10-17\\", \\"Statement\\": [{\\"Effect\\": \\"Allow\\", \\"Action\\": [\\"iot:Connect\\", \\"iot:Publish\\", \\"iot:Subscribe\\", \\"iot:Receive\\", \\"iot:GetThingShadow\\", \\"iot:DeleteThingShadow\\", \\"iot:UpdateThingShadow\\"], \\"Resource\\": [\\"*\\"]}]}\"}}}}",
        "roleArn": "arn:aws:iam::<account-id>:role/JITP-Role"
    }
}

有点迷茫，想问几个问题：

mbedTLS 似乎提供了两个串联的证书。如果其中一个不正确或者 mbedTLS 配置错误，握手会成功吗？
X509v3 扩展是否会导致 JITP 失败？设备证书有，而手动生成的没有。
有没有办法在 Cloudwatch 中记录相互身份验证失败？

有什么我遗漏的吗？

(编辑：如果我在连接时不在证书链中包含 signerCA，TLS 握手仍然成功。当然，在那种情况下，我希望 JITP 过程失败，因为 AWS 找不到关联的 CA ).

编辑2：我尝试连接 mosquitto 和一个更接近 ATECC 使用的证书（相同的算法和相同的 X509v3 扩展）。结果是一样的：用mosquitto手动生成的可以触发JITP，而ATECC的不能。

Answer 1

知道了。我在 ATECC 的错误插槽中检索了我的根证书的 public 密钥（哎哟）。这导致 atcacert_def_t 和模板在运行时生成的 signerCA 略有不同。

我错过了它，因为我在 Python 中的所有工具都在获取 right 插槽，而 C 版本没有完全同步。

JITP 证书不是使用 mbedTLS+ATECC608A 创建的（适用于 moquitto_pub）

JITP cert not created with mbedTLS+ATECC608A (works with moquitto_pub)

amazon-web-services

aws-iot

mbedtls