Invalid contents when downloading pre-provisioned certificate on SE050

[morni]

I'm trying to download one of the pre-loaded certificates using just API calls.  The cloud examples all show how to download these using VCOM and ssscli external software, and I've done that to verify, but I want to do it without the external tools.

There is an example that shows how to do this in simw-top/demos/se05x/se05x_GetCertificate, something along these lines:

      sss_status_t status;
      sss_object_t obj;
      uint8_t key[1024] = {0};
      size_t keyByteLen = sizeof(key);
      size_t keyBitLen  = keyByteLen * 8;

      status = sss_key_object_init(&obj, &pex_sss_demo_boot_ctx->ks);
      status = sss_key_object_get_handle(&obj, keyId);
      status = sss_key_store_get_key(&pex_sss_demo_boot_ctx->ks, &obj, key, &keyByteLen, &keyBitLen);

      mbedtls_x509_crt certificate;
      mbedtls_x509_crt_init(&certificate);
      mbedtls_x509_crt_parse(&certificate, (const unsigned char *)key, keyByteLen);

      // Convert to PEM text format
      std::vector< unsigned char > bufPEM( 2048, 0 );
      size_t sizePEM = 0;
      mbedtls_pem_write_buffer( "-----BEGIN CERTIFICATE-----\n", "-----END CERTIFICATE-----\n", key, keyByteLen, bufPEM.data(), bufPEM.size(), &sizePEM );

 However, the output PEM contains a few extra base64 encoded bytes before the ---END CERTIFICATE--- footer.  These extra bytes invalidate the certificate, as in when I try to register it in AWS I get an error saying the certificate is invalid.

When I extract the certificate using ssscli, the result is:
-----BEGIN CERTIFICATE-----
MIIB0DCCAXegAwIBAgIUBABQAdqb3mAVSoUEZTLaD2iAAAAwCgYIKoZIzj0EAwIw
VjEXMBUGA1UECwwOUGx1ZyBhbmQgVHJ1c3QxDDAKBgNVBAoMA05YUDEtMCsGA1UE
AwwkTlhQIEludGVybWVkaWF0ZS1Db25uZWN0aXZpdHlDQXZFMjA2MB4XDTE5MTAx
MTAwMDAwMFoXDTMxMTAwODAwMDAwMFowXzEXMBUGA1UECwwOUGx1ZyBhbmQgVHJ1
c3QxDDAKBgNVBAoMA05YUDE2MDQGA1UEAwwtRGV2Q29ubjAtMDQwMDUwMDFEQTlC
REU2MDE1NEE4NTA0NjUzMkRBMEY2ODgwMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
QgAEPs71H5esMxmP1AKyo4zUVww8LlrURX49r6mgpyvgFGMjq/Bq8J4CSrlTLs1n
AOKGOE9dZI4Zlw1uGtbVBq68iqMaMBgwCQYDVR0TBAIwADALBgNVHQ8EBAMCB4Aw
CgYIKoZIzj0EAwIDRwAwRAIgWW8X76lG72S2nhZ2nDlFk29cVsflGGwL8wy/dALP
w8UCIADxTz0IT6Ehb/KLb9WqPqp0zRXrzU4E350G8XiR2sRb
-----END CERTIFICATE-----

But using the code above, I get (note the extra AAA= at the end):
-----BEGIN CERTIFICATE-----
MIIB0DCCAXegAwIBAgIUBABQAdqb3mAVSoUEZTLaD2iAAAAwCgYIKoZIzj0EAwIw
VjEXMBUGA1UECwwOUGx1ZyBhbmQgVHJ1c3QxDDAKBgNVBAoMA05YUDEtMCsGA1UE
AwwkTlhQIEludGVybWVkaWF0ZS1Db25uZWN0aXZpdHlDQXZFMjA2MB4XDTE5MTAx
MTAwMDAwMFoXDTMxMTAwODAwMDAwMFowXzEXMBUGA1UECwwOUGx1ZyBhbmQgVHJ1
c3QxDDAKBgNVBAoMA05YUDE2MDQGA1UEAwwtRGV2Q29ubjAtMDQwMDUwMDFEQTlC
REU2MDE1NEE4NTA0NjUzMkRBMEY2ODgwMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
QgAEPs71H5esMxmP1AKyo4zUVww8LlrURX49r6mgpyvgFGMjq/Bq8J4CSrlTLs1n
AOKGOE9dZI4Zlw1uGtbVBq68iqMaMBgwCQYDVR0TBAIwADALBgNVHQ8EBAMCB4Aw
CgYIKoZIzj0EAwIDRwAwRAIgWW8X76lG72S2nhZ2nDlFk29cVsflGGwL8wy/dALP
w8UCIADxTz0IT6Ehb/KLb9WqPqp0zRXrzU4E350G8XiR2sRbAAA=
-----END CERTIFICATE-----

The first certificate can be successfully registered in AWS, but not the second. I'd appreciate any help in getting the certificates correctly from the chip. Thanks

[morni · Accepted solution]

Found the bug.

The line that generates the PEM should read the parsed certificate, instead of the raw key data.  Note, the original code in the example has the same bug, in addition to using a custom PEM genration routine that does not add line breaks and generates non standard PEM files.

Anyway, for others stumbling on this thread, the fixed line should be

      mbedtls_pem_write_buffer( "-----BEGIN CERTIFICATE-----\n", "-----END CERTIFICATE-----\n", certificate.raw.p, certificate.raw.len, bufPEM.data(), bufPEM.size(), &sizePEM );