Skip to content

Commit e3543f0

Browse files
danewalton-msftdanewalton-msft
authored
Add x509 Cert capability to esp32 (#167)
1 parent 59cde92 commit e3543f0

File tree

9 files changed

+165
-8
lines changed

9 files changed

+165
-8
lines changed

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -351,13 +351,17 @@ MigrationBackup/
351351

352352
# Build directories
353353
/build
354+
build/
354355
/mimxrt1060
355356
/build_linux
356357
/build_windows
357358
/b-l475e-iot01a
358359
/b-l4s5i-iot01a
359360
/stm32h745i-disco
360361

362+
# ESP-IDF config files
363+
sdkconfig*
364+
361365
# Gate build directories
362366
/build_pc_linux
363367
/build_nxp_mimxrt1060

‎demos/projects/ESPRESSIF/aziotkit/README.md

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,9 +77,36 @@ Parameter | Value
7777
---------|----------
7878
`Azure IoT Hub FQDN` | _{Your Azure IoT Hub Host FQDN}_ (Unused if Device Provisioning is enabled below)
7979
`Azure IoT Device ID` | _{Your Azure IoT Hub device ID}_
80-
`Azure IoT Device Symmetric Key` | _{Your Azure IoT Hub device symmetric key}_
8180
`Azure IoT Module ID` | _{Your Azure IoT Hub Module ID}_ (optional, specify module id if using a device module; else leave blank if not)
8281

82+
Select your desired authentication method with the `Azure IoT Authentication Method () --->`. The default option is `Symmetric Key`:
83+
84+
Parameter | Value
85+
---------|----------
86+
`Azure IoT Device Symmetric Key` | _{Your Azure IoT Hub device symmetric key}_
87+
88+
If you would like to use x509 certificates, select `X509 Certificates` and update the following values:
89+
90+
Parameter | Value
91+
---------|----------
92+
`Azure IoT Device Client Certificate` | _{Your Azure IoT Hub device certificate}_
93+
`Azure IoT Device Client Certificate Private Key` | _{Your Azure IoT Hub device certificate private key}_
94+
95+
Note that the certificate and private key must be a single line string with `\n` characters at the appropriate line breaks. For example:
96+
97+
```txt
98+
# Single Line (CORRECT)
99+
-----BEGIN CERTIFICATE-----\nMIIBJDCB...\nyC+koNRC0MU=\n-----END CERTIFICATE-----
100+
101+
# PEM Formatted (WRONG)
102+
-----BEGIN CERTIFICATE-----
103+
MIIBJDCBywIUfeHrebBVa2eZAbouBgACp9R3BncwCgYIKoZIzj0EAwIwETEPMA0G
104+
...
105+
vTfQahwsxN3xink9z1gtirrjQlqDAiEAyU+6TUJcG6d9JF+uJqsLFpsbbF3IzGAw
106+
yC+koNRC0MU=
107+
-----END CERTIFICATE-----
108+
```
109+
83110
> Some parameters contain default values that do not need to be updated.
84111
85112
If you're using **DPS** with an individual enrollment with SAS authentication, set the following parameters:

‎demos/projects/ESPRESSIF/aziotkit/components/sample-azure-iot/CMakeLists.txt

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,19 @@ set(ROOT_PATH
55
${CMAKE_CURRENT_LIST_DIR}/../../../../../..
66
)
77

8+
# kconfig does not support multiline strings.
9+
# For certificates, we use as a workaround escaping the newlines
10+
# in certificates and keys so they can be entered as a single
11+
# string in kconfig.
12+
# The routine below unescapes the newlines so the values
13+
# can be correctly interpreted by the code.
14+
if(EXISTS "${CMAKE_BINARY_DIR}/config/sdkconfig.h")
15+
file(READ "${CMAKE_BINARY_DIR}/config/sdkconfig.h" config_header)
16+
string(REPLACE "\\n" "n" client_certificate ${config_header})
17+
message("CLIENT_CERT: ${client_certificate}")
18+
file(WRITE "${CMAKE_BINARY_DIR}/config/sdkconfig.h" "${client_certificate}")
19+
endif()
20+
821
idf_component_get_property(MBEDTLS_DIR mbedtls COMPONENT_DIR)
922

1023
set(COMPONENT_SOURCES

‎demos/projects/ESPRESSIF/aziotkit/components/sample-azure-iot/Kconfig.projbuild

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,43 @@ menu "Azure IoT middleware for FreeRTOS Main Task Configuration"
1515
help
1616
"Set the Azure IoT Device ID."
1717

18+
choice AZURE_IOT_AUTH_METHOD
19+
prompt "Azure IoT Authentication Method"
20+
default AZURE_IOT_AUTH_METHOD_SYMMETRIC_KEY
21+
help
22+
Authentication method:
23+
24+
If "Symmetric Key" is selected, you must provide the symmetric key for the device.
25+
26+
If "X509 Certificates" is selected, you must provide the device certificate and certificate private key.
27+
28+
config AZURE_IOT_AUTH_METHOD_SYMMETRIC_KEY
29+
bool "Symmetric Key"
30+
config AZURE_IOT_AUTH_METHOD_X509
31+
bool "X509 Certificates"
32+
endchoice
33+
1834
config AZURE_IOT_DEVICE_SYMMETRIC_KEY
1935
string "Azure IoT Device Symmetric Key"
2036
default ""
37+
depends on AZURE_IOT_AUTH_METHOD_SYMMETRIC_KEY
2138
help
2239
"Set the Azure IoT Device Symmetric Key (if using SAS token authentication)."
2340

41+
config AZURE_IOT_DEVICE_CLIENT_CERTIFICATE
42+
string "Azure IoT Device Client Certificate"
43+
default ""
44+
depends on AZURE_IOT_AUTH_METHOD_X509
45+
help
46+
"Set the Azure IoT Device Client Certificate (if using x509 client authentication)."
47+
48+
config AZURE_IOT_DEVICE_CLIENT_CERTIFICATE_PRIVATE_KEY
49+
string "Azure IoT Device Client Certificate Private Key"
50+
default ""
51+
depends on AZURE_IOT_AUTH_METHOD_X509
52+
help
53+
"Set the Azure IoT Device Client Certificate Private Key (if using x509 client authentication)."
54+
2455
config AZURE_IOT_MODULE_ID
2556
string "Azure IoT Module ID"
2657
default ""

‎demos/projects/ESPRESSIF/aziotkit/config/demo_config.h

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,19 +107,25 @@
107107
* @brief Device symmetric key
108108
*
109109
*/
110+
#ifdef CONFIG_AZURE_IOT_DEVICE_SYMMETRIC_KEY
110111
#define democonfigDEVICE_SYMMETRIC_KEY CONFIG_AZURE_IOT_DEVICE_SYMMETRIC_KEY
112+
#endif
111113

112114
/**
113115
* @brief Client's X509 Certificate.
114116
*
115117
*/
116-
// #define democonfigCLIENT_CERTIFICATE_PEM "<YOUR DEVICE CERT HERE>"
118+
#ifdef CONFIG_AZURE_IOT_DEVICE_CLIENT_CERTIFICATE
119+
#define democonfigCLIENT_CERTIFICATE_PEM CONFIG_AZURE_IOT_DEVICE_CLIENT_CERTIFICATE
120+
#endif
117121

118122
/**
119123
* @brief Client's private key.
120124
*
121125
*/
122-
// #define democonfigCLIENT_PRIVATE_KEY_PEM "<YOUR DEVICE PRIVATE KEY HERE>"
126+
#ifdef CONFIG_AZURE_IOT_DEVICE_CLIENT_CERTIFICATE_PRIVATE_KEY
127+
#define democonfigCLIENT_PRIVATE_KEY_PEM CONFIG_AZURE_IOT_DEVICE_CLIENT_CERTIFICATE_PRIVATE_KEY
128+
#endif
123129

124130
/**
125131
* @brief Load the required certificates:

‎demos/projects/ESPRESSIF/esp32/README.md

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,10 +78,37 @@ Under menu item `Azure IoT middleware for FreeRTOS Main Task Configuration`, upd
7878
Parameter | Value
7979
---------|----------
8080
`Use PnP in Azure Sample` | Enabled by default. Disable this option to build a simpler sample without Azure Plug-and-Play.
81-
`Azure IoT Hub FQDN` | _{Your Azure IoT Hub Host FQDN}_
81+
`Azure IoT Hub FQDN` | _{Your Azure IoT Hub Host FQDN}_ (Unused if Device Provisioning is enabled below)
8282
`Azure IoT Device ID` | _{Your Azure IoT Hub device ID}_
83+
`Azure IoT Module ID` | _{Your Azure IoT Hub Module ID}_ (optional, specify module id if using a device module; else leave blank if not)
84+
85+
Select your desired authentication method with the `Azure IoT Authentication Method () --->`. The default option is `Symmetric Key`:
86+
87+
Parameter | Value
88+
---------|----------
8389
`Azure IoT Device Symmetric Key` | _{Your Azure IoT Hub device symmetric key}_
84-
`Azure IoT Module ID` | _{Your Azure IoT Hub Module ID}_ (IF USING A MODULE; leave blank if not)
90+
91+
If you would like to use x509 certificates, select `X509 Certificates` and update the following values:
92+
93+
Parameter | Value
94+
---------|----------
95+
`Azure IoT Device Client Certificate` | _{Your Azure IoT Hub device certificate}_
96+
`Azure IoT Device Client Certificate Private Key` | _{Your Azure IoT Hub device certificate private key}_
97+
98+
Note that the certificate and private key must be a single line string with `\n` characters at the appropriate line breaks. For example:
99+
100+
```txt
101+
# PEM Formatted (WRONG)
102+
-----BEGIN CERTIFICATE-----
103+
MIIBJDCBywIUfeHrebBVa2eZAbouBgACp9R3BncwCgYIKoZIzj0EAwIwETEPMA0G
104+
...
105+
vTfQahwsxN3xink9z1gtirrjQlqDAiEAyU+6TUJcG6d9JF+uJqsLFpsbbF3IzGAw
106+
yC+koNRC0MU=
107+
-----END CERTIFICATE-----
108+
109+
# Single Line (CORRECT)
110+
-----BEGIN CERTIFICATE-----\nMIIBJDCB...\nyC+koNRC0MU=\n-----END CERTIFICATE-----
111+
```
85112

86113
> Some parameters contain default values that do not need to be updated.
87114

‎demos/projects/ESPRESSIF/esp32/components/sample-azure-iot/CMakeLists.txt

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,19 @@ else()
1515
)
1616
endif()
1717

18+
# kconfig does not support multiline strings.
19+
# For certificates, we use as a workaround escaping the newlines
20+
# in certificates and keys so they can be entered as a single
21+
# string in kconfig.
22+
# The routine below unescapes the newlines so the values
23+
# can be correctly interpreted by the code.
24+
if(EXISTS "${CMAKE_BINARY_DIR}/config/sdkconfig.h")
25+
file(READ "${CMAKE_BINARY_DIR}/config/sdkconfig.h" config_header)
26+
string(REPLACE "\\n" "n" client_certificate ${config_header})
27+
message("CLIENT_CERT: ${client_certificate}")
28+
file(WRITE "${CMAKE_BINARY_DIR}/config/sdkconfig.h" "${client_certificate}")
29+
endif()
30+
1831
idf_component_get_property(MBEDTLS_DIR mbedtls COMPONENT_DIR)
1932

2033
list(APPEND COMPONENT_SOURCES
@@ -41,4 +54,3 @@ idf_component_register(
4154
SRCS ${COMPONENT_SOURCES}
4255
INCLUDE_DIRS ${COMPONENT_INCLUDE_DIRS}
4356
REQUIRES mbedtls tcp_transport coreMQTT azure-sdk-for-c azure-iot-middleware-freertos)
44-

‎demos/projects/ESPRESSIF/esp32/components/sample-azure-iot/Kconfig.projbuild

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,43 @@ menu "Azure IoT middleware for FreeRTOS Main Task Configuration"
2121
help
2222
"Set the Azure IoT Device ID."
2323

24+
choice AZURE_IOT_AUTH_METHOD
25+
prompt "Azure IoT Authentication Method"
26+
default AZURE_IOT_AUTH_METHOD_SYMMETRIC_KEY
27+
help
28+
Authentication method:
29+
30+
If "Symmetric Key" is selected, you must provide the symmetric key for the device.
31+
32+
If "X509 Certificates" is selected, you must provide the device certificate and certificate private key.
33+
34+
config AZURE_IOT_AUTH_METHOD_SYMMETRIC_KEY
35+
bool "Symmetric Key"
36+
config AZURE_IOT_AUTH_METHOD_X509
37+
bool "X509 Certificates"
38+
endchoice
39+
2440
config AZURE_IOT_DEVICE_SYMMETRIC_KEY
2541
string "Azure IoT Device Symmetric Key"
2642
default ""
43+
depends on AZURE_IOT_AUTH_METHOD_SYMMETRIC_KEY
2744
help
2845
"Set the Azure IoT Device Symmetric Key (if using SAS token authentication)."
2946

47+
config AZURE_IOT_DEVICE_CLIENT_CERTIFICATE
48+
string "Azure IoT Device Client Certificate"
49+
default ""
50+
depends on AZURE_IOT_AUTH_METHOD_X509
51+
help
52+
"Set the Azure IoT Device Client Certificate (if using x509 client authentication)."
53+
54+
config AZURE_IOT_DEVICE_CLIENT_CERTIFICATE_PRIVATE_KEY
55+
string "Azure IoT Device Client Certificate Private Key"
56+
default ""
57+
depends on AZURE_IOT_AUTH_METHOD_X509
58+
help
59+
"Set the Azure IoT Device Client Certificate Private Key (if using x509 client authentication)."
60+
3061
config AZURE_IOT_MODULE_ID
3162
string "Azure IoT Module ID"
3263
default ""

‎demos/projects/ESPRESSIF/esp32/config/demo_config.h

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,19 +109,25 @@
109109
* @brief Device symmetric key
110110
*
111111
*/
112+
#ifdef CONFIG_AZURE_IOT_DEVICE_SYMMETRIC_KEY
112113
#define democonfigDEVICE_SYMMETRIC_KEY CONFIG_AZURE_IOT_DEVICE_SYMMETRIC_KEY
114+
#endif
113115

114116
/**
115117
* @brief Client's X509 Certificate.
116118
*
117119
*/
118-
// #define democonfigCLIENT_CERTIFICATE_PEM "<YOUR DEVICE CERT HERE>"
120+
#ifdef CONFIG_AZURE_IOT_DEVICE_CLIENT_CERTIFICATE
121+
#define democonfigCLIENT_CERTIFICATE_PEM CONFIG_AZURE_IOT_DEVICE_CLIENT_CERTIFICATE
122+
#endif
119123

120124
/**
121125
* @brief Client's private key.
122126
*
123127
*/
124-
// #define democonfigCLIENT_PRIVATE_KEY_PEM "<YOUR DEVICE PRIVATE KEY HERE>"
128+
#ifdef CONFIG_AZURE_IOT_DEVICE_CLIENT_CERTIFICATE_PRIVATE_KEY
129+
#define democonfigCLIENT_PRIVATE_KEY_PEM CONFIG_AZURE_IOT_DEVICE_CLIENT_CERTIFICATE_PRIVATE_KEY
130+
#endif
125131

126132
/**
127133
* @brief Load the required certificates:

0 commit comments

Comments
 (0)