| #!/bin/bash |
| # |
| # |
| # Copyright 2019 NXP |
| # SPDX-License-Identifier: Apache-2.0 |
| # |
| # |
| |
| # NOTE: This script is based upon 'provisionA71CH_WatsonIoT.sh' included in the project |
| # hosted on https://github.com/ibm-watson-iot/iot-nxpimxa71ch-c |
| # |
| # |
| ######################################################################################################### |
| ## |
| |
| # Set global variables to default values |
| gExecMsg="" |
| gRetValue=0 |
| |
| # Tools |
| A71CH_CONFIG_TOOL="./a71chConfig_i2c_imx" |
| SSS_CONFIG_TOOL="ssscli" |
| |
| # Customization variables |
| # For Watson IoT Platform Device and Gateway types |
| # |
| devType="NXP-A71CH-D" |
| gwType="NXP-A71CH-G" |
| # |
| # For root CA |
| # |
| ROOT_CA_CN="NXP Semiconductors DEMO rootCA v E" |
| CA_EXISTS="FALSE" |
| CA_ENC_TYPE="ECC" # Options are RSA or ECC |
| CA_ECC_CURVE="prime256v1" # Only used if CA_ENC_TYPE is ECC |
| # CA_ECC_CURVE="secp384r1" # Only used if CA_ENC_TYPE is ECC |
| # |
| # For intermediate CA - Intermediate CA will be signed by root CA |
| # |
| CREATE_INTERMEDIATE_CA="TRUE" |
| INTERMEDIATE_CA_CN="NXP Semiconductors DEMO intermediateCA v E" |
| INTERMEDIATE_CA_EXISTS="FALSE" |
| INTERMEDIATE_CA_ENC_TYPE="ECC" # Supported type for intermedite CA is ECC |
| INTERMEDIATE_CA_ECC_CURVE="prime256v1" # Only used if INTERMEDIATE_CA_ENC_TYPE is ECC |
| # |
| # Certificate validity |
| # |
| CA_CERT_VALIDITY=7300 # 20 years |
| CLIENT_CERT_VALIDITY=7300 # 20 years |
| |
| # Root CA Files |
| if [ "${CA_ENC_TYPE}" == "RSA" ]; then |
| rootcaKey="CACertificate_RSA.key" |
| rootcaCert="CACertificate_RSA.crt" |
| ca_srl="CACertificate_RSA.srl" |
| else |
| rootcaKey="CACertificate_ECC.key" |
| rootcaCert="CACertificate_ECC.crt" |
| ca_srl="CACertificate_ECC.srl" |
| fi |
| # Intermediate CA files - RSA is not supported yet |
| intercaKey="interCACertificate_ECC.key" |
| intercaCsr="interCACertificate_ECC.csr" |
| intercaCert="interCACertificate_ECC.crt" |
| inter_srl="interCACertificate_ECC.srl" |
| # Chain of CA root and intermediate certificate |
| chaincaCert="CACertificateChain.crt" |
| |
| # UTILITY FUNCTIONS |
| # ----------------- |
| # xCmd will stop script execution when the program executed does return gRetValue (0 by default) to the shell |
| xCmd () { |
| local command="$*" |
| echo ">> ${gExecMsg}" |
| echo ">> ${command}" |
| ${command} |
| local nRetProc="$?" |
| if [ ${nRetProc} -ne ${gRetValue} ] |
| then |
| echo "\"${command}\" failed to run successfully, returned ${nRetProc}" |
| echo "** Script execution failed **" |
| exit 2 |
| fi |
| echo "" |
| # Set global variables to default values |
| gExecMsg="" |
| gRetValue=0 |
| } |
| |
| prog_usage() { |
| echo "Usage:" |
| echo " $0 [-u <UID-value>] [ip:port]" |
| } |
| |
| # Check command line arguments |
| if [ "$#" -gt 3 ]; then |
| echo "Too many arguments" |
| prog_usage |
| exit 1 |
| else |
| # default values |
| ip_addr_port_server="" |
| SE_UID="" |
| if [ "$1" == "-u" ]; then |
| if [ "$#" -lt 2 ]; then |
| prog_usage |
| exit 1 |
| else |
| SE_UID="$2" |
| if [ "${#SE_UID}" -ne 20 ]; then |
| echo " The UID (provided as argument) must be exactly 20 characters long" |
| echo "The current argument is ${#SE_UID} characters long" |
| echo "Exiting..." |
| exit 4 |
| fi |
| if [ -n "$3" ]; then |
| ip_addr_port_server="$3" |
| fi |
| fi |
| elif [ "$#" -eq 1 ]; then |
| ip_addr_port_server="$1" |
| elif [ "$#" -eq 0 ]; then |
| # No arguments is fine |
| echo "Will fetch UID from attached sample" |
| else |
| # Wrong command line options |
| prog_usage |
| exit 1 |
| fi |
| fi |
| |
| echo "SE_UID=${SE_UID}" |
| echo "ip_addr_port_server=${ip_addr_port_server}" |
| |
| # Provide UID as argument, or |
| # attach the SE and have the script retrieve the UID from the IC |
| if [ -z ${SE_UID} ]; then |
| echo " Get UID from attached SE" |
| # ${A71CH_CONFIG_TOOL} info device | grep -e "[0-9][0-9]:[0-9][0-9]:[0-9][0-9]" |
| # SE_UID="$(${A71CH_CONFIG_TOOL} info device | grep -e "\([0-9][0-9]:\)\{17,\}" \ |
| # | awk 'BEGIN {FS=":"}; {printf $3$4$9$10$11$12$13$14$15$16}')" |
| xCmd "ssscli disconnect" |
| xCmd "ssscli connect se05x t1oi2c none" |
| xCmd "ssscli se05x certuid" |
| SE_UID="$(ssscli se05x certuid 2>&1 | grep -e 'Cert UID' | grep -o -e '\([0-9a-zA-Z]\)\{20,\}')" |
| echo "SE_UID: ${SE_UID}" |
| fi |
| |
| # Sanity check on UID |
| if [ "${#SE_UID}" -ne 20 ]; then |
| echo " Could not retrieve UID from SE." |
| echo "Exiting..." |
| exit 5 |
| fi |
| |
| ########################################### |
| # Create root CA key and certificate. |
| ########################################### |
| |
| if [ "${CA_EXISTS}" != "TRUE" ]; then |
| |
| if [ "${CA_ENC_TYPE}" == "RSA" ]; then |
| |
| # RSA Root Certificates |
| if [ ! -e ${rootcaKey} ]; then |
| # Create both the CA keypair and CA certificate |
| # The root CA is RSA 4096 |
| echo "## Create RSA Root CA Key: (${rootcaKey})" |
| xCmd "openssl genrsa -out ${rootcaKey} 4096" |
| echo "## Create RSA Root CA Certificate: (${rootcaCert})" |
| openssl req -x509 -new -nodes -key ${rootcaKey} -sha256 -days ${CA_CERT_VALIDITY} -out ${rootcaCert} -subj "/CN=${ROOT_CA_CN}" |
| fi |
| |
| if [ ! -e ${rootcaCert} ]; then |
| echo "## Create ECC Root CA Certificate: (${rootcaCert}); Root CA keypair was already present" |
| openssl req -x509 -new -nodes -key ${rootcaKey} -sha256 -days ${CA_CERT_VALIDITY} -out ${rootcaCert} -subj "/CN=${ROOT_CA_CN}" |
| fi |
| |
| else |
| |
| # ECC Root Certificates |
| if [ ! -e ${rootcaKey} ]; then |
| # Create both the CA keypair and CA certificate |
| # The root CA is ECC using curve defined in CA_ECC_CURVE variable |
| echo "## Create ECC Root CA Key: (${rootcaKey}) Curve: (${CA_ECC_CURVE})" |
| xCmd "openssl ecparam -genkey -name ${CA_ECC_CURVE} -out ${rootcaKey}" |
| echo "## Create ECC Root CA Certificate: (${rootcaCert})" |
| openssl req -x509 -new -nodes -key ${rootcaKey} -sha256 -days ${CA_CERT_VALIDITY} -out ${rootcaCert} -subj "/CN=${ROOT_CA_CN}" |
| fi |
| |
| if [ ! -e ${rootcaCert} ]; then |
| echo "## Create ECC Root CA Certificate: (${rootcaCert}); Root CA keypair was already present" |
| openssl req -x509 -new -nodes -key ${rootcaKey} -sha256 -days ${CA_CERT_VALIDITY} -out ${rootcaCert} -subj "/CN=${ROOT_CA_CN}" |
| fi |
| |
| fi |
| |
| else |
| # Check whether RootCA key and certificate are present. |
| if [ ! -e ${rootcaKey} ]; then |
| if [ "${CA_ENC_TYPE}" == "RSA" ]; then |
| echo "## No RSA Root CA Key available (${rootcaKey})" |
| else |
| echo "## No ECC Root CA Key available (${rootcaKey})" |
| fi |
| exit 8 |
| fi |
| |
| if [ ! -e ${rootcaCert} ]; then |
| if [ "${CA_ENC_TYPE}" == "RSA" ]; then |
| echo "## No RSA Root CA Certificate available (${rootcaCert})" |
| else |
| echo "## No ECC Root CA Certificate available (${rootcaCert})" |
| fi |
| exit 9 |
| fi |
| fi |
| |
| |
| ############################################## |
| # Create intermediate CA key and certificate. |
| ############################################## |
| |
| # echo "Check whether a .srl file of Root CA is present" |
| if [ -e ${ca_srl} ]; then |
| echo "## ${ca_srl} already exists, use it" |
| x509_serial="-CAserial ${ca_srl}" |
| else |
| echo "## no ${ca_srl} found, create it" |
| x509_serial="-CAcreateserial" |
| fi |
| |
| SIGN_BY_INTERMEDIATE_CA="FALSE" |
| |
| echo "## CREATE_INTERMEDIATE_CA = ${CREATE_INTERMEDIATE_CA}" |
| |
| if [ "${CREATE_INTERMEDIATE_CA}" == "TRUE" ] |
| then |
| |
| echo "## Create Intermediate CA" |
| |
| if [ "${INTERMEDIATE_CA_EXISTS}" != "TRUE" ] |
| then |
| |
| # Define the v3 extension that will be included in the intermediate certificate |
| echo "## Create v3 extension file for Intermediate CA Certificate" |
| echo "[ v3_req ]" > v3_ext.cnf |
| echo "basicConstraints = CA:TRUE, pathlen:0" >> v3_ext.cnf |
| echo "keyUsage = critical, digitalSignature, keyCertSign" >> v3_ext.cnf |
| |
| |
| if [ "${INTERMEDIATE_CA_ENC_TYPE}" == "RSA" ] |
| then |
| |
| echo "## RSA Encryption type is not supported yet." |
| exit 10 |
| |
| else |
| |
| # ECC Intemediate Certificates |
| if [ ! -e ${intercaKey} ] |
| then |
| # Create both the CA keypair and CA certificate |
| # The intermediate CA is ECC using curve defined in INTERMEDIATE_CA_ECC_CURVE variable |
| echo "## Create ECC intermediate CA Key: (${intercaKey}) Curve: (${INTERMEDIATE_CA_ECC_CURVE})" |
| xCmd "openssl ecparam -genkey -name ${INTERMEDIATE_CA_ECC_CURVE} -out ${intercaKey}" |
| echo "## Create ECC Intermediate CA CSR: (${intercaCsr})" |
| openssl req -new -key ${intercaKey} -out ${intercaCsr} -subj "/CN=${INTERMEDIATE_CA_CN}" |
| echo "## Sign Intermediate CA CSR with (${rootcaCert})" |
| openssl x509 -req -days ${CA_CERT_VALIDITY} -in ${intercaCsr} ${x509_serial} -CA ${rootcaCert} \ |
| -CAkey ${rootcaKey} -extfile ./v3_ext.cnf -extensions v3_req -out ${intercaCert} |
| fi |
| |
| if [ ! -e ${intercaCert} ]; then |
| echo "## Create ECC Intermediate CA CSR: (${intercaCsr})" |
| openssl req -new -key ${intercaKey} -out ${intercaCsr} -subj "/CN=${INTERMEDIATE_CA_CN}" |
| echo "## Sign Intermediate CA CSR with (${rootcaCert})" |
| openssl x509 -req -days ${CA_CERT_VALIDITY} -in ${intercaCsr} ${x509_serial} -CA ${rootcaCert} \ |
| -CAkey ${rootcaKey} -extfile ./v3_ext.cnf -extensions v3_req -out ${intercaCert} |
| fi |
| |
| fi |
| |
| else |
| |
| # Check whether Intermediate CA key and certificate are present. |
| if [ ! -e ${intercaKey} ]; then |
| if [ "${INTERMEDIATE_CA_ENC_TYPE}" == "RSA" ]; then |
| echo "## RSA Encryption type is not supported yet." |
| else |
| echo "## No ECC Intermediate CA Key available (${intercaKey})" |
| fi |
| exit 11 |
| fi |
| |
| if [ ! -e ${intercaCert} ]; then |
| if [ "${INTERMEDIATE_CA_ENC_TYPE}" == "RSA" ]; then |
| echo "## RSA Encryption type is not supported yet." |
| else |
| echo "## No ECC Intermediate CA Certificate available (${intercaCert})" |
| fi |
| exit 12 |
| fi |
| |
| fi |
| |
| SIGN_BY_INTERMEDIATE_CA="TRUE" |
| |
| fi |
| |
| |
| ############################################ |
| # Create key and device/gateway certificates |
| ############################################ |
| |
| if [ "${SIGN_BY_INTERMEDIATE_CA}" == "TRUE" ]; then |
| |
| # Create Chain of CA Certificates for WIoTP CA Certificate upload step |
| cat ${intercaCert} ${rootcaCert} > ${chaincaCert} |
| fi |
| |
| # Create serial number of gateway and device certificates |
| # for device 1${SE_UID} |
| # for gateway 2${SE_UID} |
| deviceSerial="0x01${SE_UID}" |
| gatewaySerial="0x02${SE_UID}" |
| |
| # Unique ID Key, reference key and CSR files |
| uidKey="${SE_UID}.key" |
| uidRefKey="${SE_UID}_ref.pem" |
| uidCsr="${SE_UID}.csr" |
| |
| # Device certificate |
| deviceCert="${SE_UID}_device_ec_pem.crt" |
| deviceCertAscii="${SE_UID}_device_ec_crt_ascii_dump.txt" |
| |
| # Gateway certificate |
| gatewayCert="${SE_UID}_gateway_ec_pem.crt" |
| gatewayCertAscii="${SE_UID}_gateway_ec_crt_ascii_dump.txt" |
| |
| echo "## Preparing device certificate ${deviceCert}" |
| CN_val="${SE_UID}" |
| GENERIC_val="URI:NXP:${SE_UID}" |
| SAN_D_val="email:d:${devType}:${SE_UID}, ${GENERIC_val}" |
| SAN_G_val="email:g:${gwType}:${SE_UID}, ${GENERIC_val}" |
| |
| echo "## CN=${CN_val}" |
| echo "## SAN_D_VAL=${SAN_D_val}" |
| echo "## SAN_G_VAL=${SAN_G_val}" |
| |
| # Create a device key pair & CSR |
| xCmd "openssl ecparam -genkey -name prime256v1 -out ${uidKey}" |
| openssl req -new -key ${uidKey} -out ${uidCsr} -subj "/CN=${CN_val}" |
| |
| # Define the v3 extension that will be included in the device certificate |
| echo "[ v3_req ]" > v3_ext.cnf |
| echo "" >> v3_ext.cnf |
| echo "# Extensions to add to a certificate request" >> v3_ext.cnf |
| echo "" >> v3_ext.cnf |
| echo "basicConstraints = CA:FALSE" >> v3_ext.cnf |
| echo "# keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> v3_ext.cnf |
| echo "keyUsage = digitalSignature" >> v3_ext.cnf |
| echo "subjectAltName = ${SAN_D_val}" >> v3_ext.cnf |
| |
| if [ "${SIGN_BY_INTERMEDIATE_CA}" == "TRUE" ]; then |
| # Create a Cert signed by Intermediate CA |
| xCmd "openssl x509 -req -days ${CLIENT_CERT_VALIDITY} -in ${uidCsr} -set_serial ${deviceSerial} -CA ${intercaCert} -CAkey ${intercaKey} \ |
| -extfile ./v3_ext.cnf -extensions v3_req -out ${deviceCert}" |
| else |
| # Create a Cert signed by Root CA |
| xCmd "openssl x509 -req -days ${CLIENT_CERT_VALIDITY} -in ${uidCsr} -set_serial ${deviceSerial} -CA ${rootcaCert} -CAkey ${rootcaKey} \ |
| -extfile ./v3_ext.cnf -extensions v3_req -out ${deviceCert}" |
| fi |
| openssl x509 -in ${deviceCert} -text -noout > ${deviceCertAscii} |
| echo "## Device certificate ${deviceCert} created successfully" |
| |
| |
| # Define the v3 extension that will be included in the gateway certificate |
| echo "[ v3_req ]" > v3_ext.cnf |
| echo "" >> v3_ext.cnf |
| echo "# Extensions to add to a certificate request" >> v3_ext.cnf |
| echo "" >> v3_ext.cnf |
| echo "basicConstraints = CA:FALSE" >> v3_ext.cnf |
| echo "# keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> v3_ext.cnf |
| echo "keyUsage = digitalSignature" >> v3_ext.cnf |
| echo "subjectAltName = ${SAN_G_val}" >> v3_ext.cnf |
| if [ "${SIGN_BY_INTERMEDIATE_CA}" == "TRUE" ]; then |
| # Create a Cert signed by Intermediate CA |
| xCmd "openssl x509 -req -days ${CLIENT_CERT_VALIDITY} -in ${uidCsr} -set_serial ${gatewaySerial} -CA ${intercaCert} -CAkey ${intercaKey} \ |
| -extfile ./v3_ext.cnf -extensions v3_req -out ${gatewayCert}" |
| else |
| # Create a Cert signed by Root CA |
| xCmd "openssl x509 -req -days ${CLIENT_CERT_VALIDITY} -in ${uidCsr} -set_serial ${gatewaySerial} -CA ${rootcaCert} -CAkey ${rootcaKey} \ |
| -extfile ./v3_ext.cnf -extensions v3_req -out ${gatewayCert}" |
| fi |
| openssl x509 -in ${gatewayCert} -text -noout > ${gatewayCertAscii} |
| echo "## Gateway certificate ${gatewayCert} created successfully" |
| |
| |
| ########################################### |
| # Create config tool script and execute it. |
| ########################################### |
| |
| configScript="${SE_UID}_se050ConfigScript.sh" |
| |
| echo "## Create config tool script ${configScript}" |
| |
| echo "# ################################################" > ${configScript} |
| echo "# Name: ${configScript}" >> ${configScript} |
| echo "# Revision 0.9" >> ${configScript} |
| echo "# Purpose: Provision SE050 matching UID ("${SE_UID}") for Watson IoT" >> ${configScript} |
| echo "# Pre-condition: " >> ${configScript} |
| echo "# Post-condition: keypair and certificate injected" >> ${configScript} |
| echo "# ################################################" >> ${configScript} |
| echo "ssscli disconnect" >> ${configScript} |
| echo "ssscli connect se05x t1oi2c none" >> ${configScript} |
| echo "ssscli se05x reset # Bring secure element in its original state" >> ${configScript} |
| echo "# key_id=\"0x7DC1B000\"" >> ${configScript} |
| echo "ssscli set ecc pair 0x7DC1B000 ${uidKey} --format PEM" >> ${configScript} |
| echo "ssscli refpem ecc pair 0x7DC1B000 ${uidRefKey} # Creates the reference key on the file system" >> ${configScript} |
| # echo "# dev_cert_id=\"0x7DC1B010\"" >> ${configScript} |
| # echo "ssscli set cert 0x7DC1B010 ${deviceCert}" >> ${configScript} |
| # echo "# gw_cert_id=\"0x7DC1B011\"" >> ${configScript} |
| # echo "ssscli set cert 0x7DC1B011 ${gatewayCert}" >> ${configScript} |
| |
| # ssscli set cert [OPTIONS] KEYID KEY |
| |
| # xCmd "${A71CH_CONFIG_TOOL} script -f ${configScript}" |
| |
| # echo "## Successfully configured A71CH sample ${SE_UID}" |
| |
| exit 0 |
| |
| |
