Closed ksaye closed 3 years ago
could not get EST bootstrap identity cert private key: a parameter has an invalid value
The problem is the key, not the cert.
If that really is your entire /etc/aziot/config.toml
, then it's missing the [pkcs11]
section where you'd configure (at least) the path of the tpm2_pkcs11.so, so the bootstrap key specified via pkcs11:
URI won't work.
If your /etc/aziot/config.toml
does have a [pkcs11]
section and you just redacted it when posting here, then post the logs of aziot-keyd from the same time period so we can see why it rejected the key handle request.
@arsing, that was such a rookie mistake on my part (missing the [pkcs11] section). Thank you.
Expected Behavior
Trying to setup Edge 1.2 using the TPM2-PKCS11 for the private key for the bootstrap cert.
Current Behavior
I am getting the erro:
Steps to Reproduce
Provide a detailed set of steps to reproduce the bug.
Note my SSL Cert looks good, and if I use the same process but not store in TPM it works fine.
Context (Environment)
Output of
iotedge check
Click here
``` sudo iotedge check Configuration checks (aziot-identity-service) --------------------------------------------- √ keyd configuration is well-formed - OK √ certd configuration is well-formed - OK √ tpmd configuration is well-formed - OK √ identityd configuration is well-formed - OK √ daemon configurations up-to-date with config.toml - OK √ identityd config toml file specifies a valid hostname - OK √ aziot-identity-service package is up-to-date - OK √ host time is close to reference time - OK √ production readiness: identity certificates expiry - OK × production readiness: EST identity and bootstrap certificates expiry - Error x509 identity certificate is neither preloaded nor configured to be dynamically issued, and thus cannot be used. √ preloaded certificates are valid - OK √ keyd is running - OK √ certd is running - OK √ identityd is running - OK × read all preloaded certificates from the Certificates Service - Error could not load cert with ID "aziot-edged-trust-bundle" Caused by: parameter "id" has an invalid value caused by: not found √ read all preloaded key pairs from the Keys Service - OK √ ensure all preloaded certificates match preloaded private keys with the same ID - OK Connectivity checks (aziot-identity-service) -------------------------------------------- ‼ host can connect to and perform TLS handshake with iothub AMQP port - Warning Could not retrieve iothub_hostname from provisioning file. Please specify the backing IoT Hub name using --iothub-hostname switch if you have that information. Since no hostname is provided, all hub connectivity tests will be skipped. ‼ host can connect to and perform TLS handshake with iothub HTTPS / WebSockets port - Warning Could not retrieve iothub_hostname from provisioning file. Please specify the backing IoT Hub name using --iothub-hostname switch if you have that information. Since no hostname is provided, all hub connectivity tests will be skipped. ‼ host can connect to and perform TLS handshake with iothub MQTT port - Warning Could not retrieve iothub_hostname from provisioning file. Please specify the backing IoT Hub name using --iothub-hostname switch if you have that information. Since no hostname is provided, all hub connectivity tests will be skipped. √ host can connect to and perform TLS handshake with DPS endpoint - OK Configuration checks -------------------- √ aziot-edged configuration is well-formed - OK √ configuration up-to-date with config.toml - OK √ container engine is installed and functional - OK ```Device Information
Runtime Versions
iotedge version
]: 1.2.0docker version
]: 20.10.6+azureNote: when using Windows containers on Windows, run
docker -H npipe:////./pipe/iotedge_moby_engine version
insteadLogs
aziot-edged logs
```edge-agent logs
```edge-hub logs
```Additional Information
Please provide any additional information that may be helpful in understanding the issue.