Local PKI integration

[reubenmiller]

Support registration of child devices via a local PKI service

Overview

• Integrate the PKI registration process with local child device registration
• Managed of the local intermediate CA certificate (via thin-edge.io)

Some examples of some tools are:

• step-CA by smallstep
• Hashicorp Vault - comparison with smallstep step-ca
• ejbca-ce - though this is java based but still could be used for research
• cfssl

[didier-wenzek]

Requirements:

• Create certificates for the main devices - trusted by the cloud tenant
• Create local certificates trusted at the scale of a local MQTT bus: for the broker, the main device, its child-devices and services.
• Control the purpose of each certificate (MQTT cloud connection, local MQTT broker, MQTT client, HTTP server, HTTP client)
• Control the signing certificates:
  • two main devices should be able to use different signing certificates for their child devices
  • a main device connected to two different cloud end-points should be able to use cloud specific certificates
• Support verifications on IP addresses: not all devices will have a well-known DNS name
• Enroll devices even if not directly connected to the cloud (a typical child device is not)
• Prohibit the use of open ports accessible from the cloud
• Provide the user an overall view of the certificates in use on a local MQTT bus.
• Automatic certificate renewal (i.e. the device needs to know where is its CA or RA).
• Revoke local certificates
• Enrollment of devices booting a thin-edge image preconfigured with a well-known CA or RA
• Flexible enough to be used with SmallStep, DigiCert, Nexus ... with or without an intermediate CA
• Provide a test CA server to ease pre-prod use cases (evaluation, dev, tests)

Questions:

• ACME? EST? both?
• What types of challenges? Proofs of ownership?
• Value of an intermediate Registration Authority (RA) - on the main device ? on the cloud tenant?

[didier-wenzek]

Proposal

• Implement a tool supporting operators in their device bootstrapping tasks
  • with the same spirit as c8y-tedge
  • but being less Cumulocity specific.
• This tool will not be deployed on the edge but on the operator laptops.
  • acting as proxy between the cloud (CA & tenant) and the local network (devices and child-devices)
  • removing the needs for well-known DNS entries and open ports on the devices
  • reducing the number of points that need to be trusted by the CA to bootstrap devices
• Its main feature will be to act a Registration Authority (RA)
  • collecting CSR from thin-edge devices / child devices / services
  • verifying locally these CSRs
  • signing and forwarding these CSRs to the actual CA
  • returning the certificates to the devices
  • addressing the diversity of protocol and proof of ownership
• In a pre-production context, this tool can also acts as a local CA
  • storing the signing keys on the operators' laptop

[didier-wenzek]

This has been implemented as a c8y-tedge extension POC.

[reubenmiller]

An example community plugin has been created to show off support for how to a local PKI to issue and renew local certificates for secure access to the local MQTT broker and local services like the File Transfer Service and the Cumulocity Local Proxy.

• https://github.com/thin-edge/tedge-pki-smallstep

The above project is also integrated into the tedge demo setup by default. https://github.com/thin-edge/tedge-demo-container