To use X509 authentication, you must generate self-signed certificates where the Common Name (CN) matches your DeviceId.
1. Create configuration file
Create x509_config.cfg to define client authentication extensions:
cat > x509_config.cfg <<EOT
[req]
req_extensions = client_auth
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ client_auth ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth
EOT
2. Generate Certificates
For RSA:
# Generate private key and certificate
openssl genrsa -out privkey.pem 2048
openssl req -new -days 365 -nodes -x509 -key privkey.pem -out cert.pem -config x509_config.cfg -subj "/CN=<Same as device Id>"
# Convert to DER format
openssl rsa -outform der -in privkey.pem -out privkey.der
openssl x509 -outform der -in cert.pem -out cert.der
For EC (Elliptic Curve):
# Generate private key and certificate
openssl req -new -x509 -nodes -days 365 -newkey ec:<(openssl ecparam -name secp384r1) -keyout privkey.pem -out cert.pem -config x509_config.cfg -subj "/CN=<Same as device Id>"
# Convert to DER format
openssl ec -outform der -in privkey.pem -out privkey.der
openssl x509 -outform der -in cert.pem -out cert.der
3. Convert DER to C hex arrays
Use xxd to convert the .der files into hex arrays and append them to sample_device_identity.c:
xxd -i cert.der | sed -E "s/(unsigned char) (\w+)/\1 sample_device_cert_ptr/g; s/(unsigned int) (\w+)_len/\1 sample_device_cert_len/g" >> sample_device_identity.c
xxd -i privkey.der | sed -E "s/(unsigned char) (\w+)/\1 sample_device_private_key_ptr/g; s/(unsigned int) (\w+)_len/\1 sample_device_private_key_len/g" >> sample_device_identity.c