Get the CSR

This commit is contained in:
Pierre HUBERT 2024-08-16 11:51:33 +02:00
parent 0c11703cea
commit 9966904e4d
4 changed files with 80 additions and 2 deletions

View File

@ -2,6 +2,7 @@
#include "system.h" #include "system.h"
#include "constants.h" #include "constants.h"
#include "storage.h" #include "storage.h"
#include "dev_name.h"
#include <string.h> #include <string.h>
#include <mbedtls/build_info.h> #include <mbedtls/build_info.h>
@ -11,6 +12,7 @@
#include <mbedtls/ecdsa.h> #include <mbedtls/ecdsa.h>
#include <mbedtls/sha256.h> #include <mbedtls/sha256.h>
#include <mbedtls/pk.h> #include <mbedtls/pk.h>
#include <mbedtls/x509_csr.h>
#define ECPARAMS MBEDTLS_ECP_DP_SECP256R1 #define ECPARAMS MBEDTLS_ECP_DP_SECP256R1
@ -80,6 +82,10 @@ bool crypto_gen_priv_key()
storage_set_priv_key(key_buff + PRV_KEY_DER_MAX_BYTES - ret, ret); storage_set_priv_key(key_buff + PRV_KEY_DER_MAX_BYTES - ret, ret);
free(key_buff); free(key_buff);
mbedtls_pk_free(&key);
mbedtls_ctr_drbg_free(&ctr_drbg);
mbedtls_entropy_free(&entropy);
return true; return true;
} }
@ -105,6 +111,7 @@ void crypto_print_priv_key()
(unsigned int)-ret); (unsigned int)-ret);
reboot(); reboot();
} }
free(key_buff);
printf("Show private key\n"); printf("Show private key\n");
unsigned char *out = malloc(16000); unsigned char *out = malloc(16000);
@ -119,5 +126,64 @@ void crypto_print_priv_key()
printf("%s", out); printf("%s", out);
free(out); free(out);
free(key_buff); mbedtls_pk_free(&key);
mbedtls_ctr_drbg_free(&ctr_drbg);
mbedtls_entropy_free(&entropy);
}
char *crypto_get_csr()
{
int ret;
unsigned char *key_buff = malloc(PRV_KEY_DER_MAX_BYTES);
size_t key_len = storage_get_priv_key(key_buff);
assert(key_len > 0);
mbedtls_pk_context key;
mbedtls_pk_init(&key);
mbedtls_entropy_context entropy;
mbedtls_ctr_drbg_context ctr_drbg;
seed_ctr_drbg_context(&entropy, &ctr_drbg);
printf("Parse private key (len = %d)\n", key_len);
if ((ret = mbedtls_pk_parse_key(&key, key_buff, key_len, NULL, 0, mbedtls_ctr_drbg_random, &ctr_drbg)) != 0)
{
mbedtls_printf(" failed\n ! mbedtls_pk_parse_key returned -0x%04x",
(unsigned int)-ret);
reboot();
}
free(key_buff);
// Create CSR
mbedtls_x509write_csr req;
mbedtls_x509write_csr_init(&req);
mbedtls_x509write_csr_set_md_alg(&req, MBEDTLS_MD_SHA256);
char subj[DEV_NAME_LEN + 4];
char *n = dev_name();
sprintf(subj, "CN=%s", n);
free(n);
if ((ret = mbedtls_x509write_csr_set_subject_name(&req, subj)) != 0)
{
mbedtls_printf(" failed\n ! mbedtls_x509write_csr_set_subject_name returned %d", ret);
reboot();
}
printf("Sign CSR with private key\n");
mbedtls_x509write_csr_set_key(&req, &key);
char *csr = malloc(4096);
if ((ret = mbedtls_x509write_csr_pem(&req, (u_char *)csr, 4096, mbedtls_ctr_drbg_random, &ctr_drbg)) < 0)
{
mbedtls_printf(" failed\n ! mbedtls_x509write_csr_pem returned %d", ret);
reboot();
}
mbedtls_x509write_csr_free(&req);
mbedtls_pk_free(&key);
mbedtls_ctr_drbg_free(&ctr_drbg);
mbedtls_entropy_free(&entropy);
return csr;
} }

View File

@ -23,6 +23,14 @@ extern "C"
*/ */
void crypto_print_priv_key(); void crypto_print_priv_key();
/**
* Get CSR
*
* @return NULL in case of failure or a buffer that must be
* freed in case of success
*/
char *crypto_get_csr();
#ifdef __cplusplus #ifdef __cplusplus
} }
#endif #endif

View File

@ -32,5 +32,9 @@ void app_main(void)
printf("Device private key:\n"); printf("Device private key:\n");
crypto_print_priv_key(); crypto_print_priv_key();
char *csr = crypto_get_csr();
printf("Current CSR:\n%s\n", csr);
free(csr);
reboot(); reboot();
} }

View File

@ -31,7 +31,7 @@ void storage_set_dev_name(const char *name)
ESP_ERROR_CHECK(nvs_open(STORAGE_NAMESPACE, NVS_READWRITE, &my_handle)); ESP_ERROR_CHECK(nvs_open(STORAGE_NAMESPACE, NVS_READWRITE, &my_handle));
ESP_ERROR_CHECK(nvs_set_blob(my_handle, DEV_NAME_KEY, name, strlen(name))); ESP_ERROR_CHECK(nvs_set_blob(my_handle, DEV_NAME_KEY, name, strlen(name) + 1));
nvs_close(my_handle); nvs_close(my_handle);
} }