Certificates on IoT Edge

Question

Certificates on IoT Edge

bcb44 31

Hello,

I'm trying to develop a solution w IoT edge and want to know if there's a way to use a simpler, more out of the box certificate chain structure than the recommended structure for x509 (https://learn.microsoft.com/en-us/azure/iot-edge/iot-edge-certs?view=iotedge-2018-06). Is it possible to implement it without needing the workload cert? Or ideally to not even need the edgeHub cert and only have one certificate on the device?

I'm controlling the device for 100% of the time and want to use a managed private PKI (rather than OpenSSL or LibreSSL) but am worried about the cost of a more customized solution like the one in the docs.

Alberto Gorni 11 Reputation points

2020-11-18T13:51:30.313+00:00

What's your objective?

I mean are you trying to use X.509 certs as attestation method to IoT Hub (in this case look at this doc: https://learn.microsoft.com/en-us/azure/iot-edge/how-to-manual-provision-x509?view=iotedge-2018-06&tabs=azure-portal%2Clinux)

Or are you talking about the certificates required from edgeHub as we suggest in the doc you linked and here: https://learn.microsoft.com/en-us/azure/iot-edge/how-to-manage-device-certificates?view=iotedge-2018-06

And as suggested for production readiness:
https://learn.microsoft.com/en-us/azure/iot-edge/production-checklist?view=iotedge-2018-06#install-production-certificates
bcb44 31 Reputation points

2020-11-18T19:08:52.84+00:00

@Alberto Gorni Yes I'm trying to use X.509 certs as an attestation method between IoT Hub and IoT Edge as well as between IoT Edge and a leaf device. My objective is to reduce the number of CA certificates on the device (ideally to one) so that I can reduce the cost of my private PKI. I'm wondering if there is flexibility in the IoT Edge cert change structure so it could match my use case a little more

I'm the "operator" and the "manufacturer" as defined in the doc I attached before so the device won’t ever change hands. So I don't think I need the workload CA cert.

Honestly, I'm also a little bit confused about whether I need the device cert to be a CA at all. I'm placing the device in a very secure location so both the hardware and software are within my trust boundary and it seems like I could just use one single cert to show to verify to the overall device identity rather than having to verify the identity of each module on the device.
bcb44 31 Reputation points

2020-11-18T19:15:36.997+00:00

Apologies if these are basic questions, I'm working (and learning) a lot of this on the fly right now
bcb44 31 Reputation points

2020-11-25T17:28:18.4+00:00

@Alberto Gorni Just following up here, is there any flexibility in the certificate chain of the IoT Edge product?
António Sérgio Azevedo 7,671 Reputation points Microsoft Employee Moderator

2020-12-09T07:57:37.267+00:00
Hello @bcb44 ,
Please share with us if you have any other questions related with your original post. Otherwise could you go ahead and mark the below as answer so community members can benefit from a richer content? :)

Thank you so much.

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

1 answer

Your answer

Alberto Gorni 11 Reputation points

2020-11-18T13:51:30.313+00:00

What's your objective?

I mean are you trying to use X.509 certs as attestation method to IoT Hub (in this case look at this doc: https://learn.microsoft.com/en-us/azure/iot-edge/how-to-manual-provision-x509?view=iotedge-2018-06&tabs=azure-portal%2Clinux)

Or are you talking about the certificates required from edgeHub as we suggest in the doc you linked and here: https://learn.microsoft.com/en-us/azure/iot-edge/how-to-manage-device-certificates?view=iotedge-2018-06

And as suggested for production readiness:
https://learn.microsoft.com/en-us/azure/iot-edge/production-checklist?view=iotedge-2018-06#install-production-certificates
bcb44 31 Reputation points

2020-11-18T19:08:52.84+00:00

@Alberto Gorni Yes I'm trying to use X.509 certs as an attestation method between IoT Hub and IoT Edge as well as between IoT Edge and a leaf device. My objective is to reduce the number of CA certificates on the device (ideally to one) so that I can reduce the cost of my private PKI. I'm wondering if there is flexibility in the IoT Edge cert change structure so it could match my use case a little more

I'm the "operator" and the "manufacturer" as defined in the doc I attached before so the device won’t ever change hands. So I don't think I need the workload CA cert.

Honestly, I'm also a little bit confused about whether I need the device cert to be a CA at all. I'm placing the device in a very secure location so both the hardware and software are within my trust boundary and it seems like I could just use one single cert to show to verify to the overall device identity rather than having to verify the identity of each module on the device.
bcb44 31 Reputation points

2020-11-18T19:15:36.997+00:00

Apologies if these are basic questions, I'm working (and learning) a lot of this on the fly right now
bcb44 31 Reputation points

2020-11-25T17:28:18.4+00:00

@Alberto Gorni Just following up here, is there any flexibility in the certificate chain of the IoT Edge product?
António Sérgio Azevedo 7,671 Reputation points Microsoft Employee Moderator

2020-12-09T07:57:37.267+00:00

Hello @bcb44 ,
Please share with us if you have any other questions related with your original post. Otherwise could you go ahead and mark the below as answer so community members can benefit from a richer content? :)

Thank you so much.

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Answer 1

Hello @bcb44 thank you for asking very good questions :).

Going directly to your main question "Is it possible to implement it without needing the workload cert? Or ideally to not even need the edgeHub cert and only have one certificate on the device?" the short answer is no. Nevertheless Microsoft maintains the main code base for the IoT Edge security daemon on GitHub and you are free to customize the code for your scenario. But let me first try to bring some clarity on why you need a (1) workload CA, a (2) Device CA and a (3) Root CA certificates even when being the "operator" and the "manufacturer" of the device.

The workload CA is generated by the IoT Edge security manager when IoT Edge first starts - you don't need to care about having it on your private PKI. Leaf devices do not need to know anything about the workload CA as the chain goes all back to the Root CA used to sign the Device CA (stored securily in your iot edge gateway). As for the modules deployed by the iot edge, they will access the Workload API that provides proof of identity and the corresponding trust bundle to a module - you also don't need to worry about having the module's certificates in your private PKI as all is managed by the IoT Edge security manager.
The Device CA needs to be secured in your IoT Edge Gateway, preferably in secure storage such as a hardware security module (HSM) because it contains a private key. If you want to leverage it, your PKI should be able to move the Device CA file to the IoT Edge Gateway.
The server certificate chain that comprises your root certificate authority (CA) certificate and the intermediate CA certificate need also to be deployed on your IoT Edge Gateway. The only CA * that your leaf device needs to have is the Root CA used to generate the Device CA in the gateway - Your downstream device uses this certificate to validate the identity of the gateway device.

* If you want your Leaf Device to connect to IoTHub (authenticated with X509) when iot edge is acting as a transparent gateway, then your leaf device needs also to access the X509 Leaf Device cert generated by the same Root CA of your IoT Edge Gateway Device CA.

Please understand that all we are trying to achieve is that we have a client validation of the server certificate chain, also called server chain validation, where the IoT Edge Gateway is the server and the leaf device or modules are the clients. That is needed to enable a TLS (transport layer security) secure connection between the runtime, the modules, and the IoT devices. To maintain reasonable security, the downstream device should confirm the identity of the gateway device. This identity check prevents your devices from connecting to potentially malicious gateways. See as well TLS and certificate fundamentals

Hope I could help and thanks @Alberto Gorni for bringing the very relevant docs on your comment as well.

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.
Want a reminder to come back and check responses? Here is how to subscribe to a notification.

Share via

Certificates on IoT Edge

1 answer

Your answer