EdgeLock SE051: Retrieve inbuild certificate and key (or key reference)

[mukeshkumar_prajapati]

Hello,

In SE051, I am able to inject key and retrieve key reference of it, which is generated outside of it, but just now I come to know that SE051 has its own certificate and key which is build while manufacturing time and unique across the each SE051 chip.

I want to use these inbuild certificate and key for TLS mutual authentication, can anyone support me how can I retrieve inbuild certificate and key (or key reference)? 

Thanks,

Mukesh Prajapati

[mukeshkumar_prajapati]

Hello @Kan_Li ,

Thanks for your reply. but it will not help me for my task.

My questions were,

1. Does SE051 chip come with inbuild certificate and key which are injected while manufacturing time? if so than we do not need to inject any certificate and key, can be used same for our purpose.
2. if SE051 comes with injected certificate and key, are they unique across chipset?
3. Which are tools required to retrieve certificate and private key (or private key reference)?

Could you please help me with above questions.

Thanks,

Mukesh Prajapati

[Kan_Li]

Hi @mukeshkumar_prajapati ,

Please kindly have my comments as below:

1. Does SE051 chip come with inbuild certificate and key which are injected while manufacturing time? if so than we do not need to inject any certificate and key, can be used same for our purpose. - Yes , SE051 comes with NXP provisioned certs and keys except SE051P2 which supports custom applet development instead.  Please refer to https://www.nxp.com/docs/en/application-note/AN12973.pdf for more details.
2. if SE051 comes with injected certificate and key, are they unique across chipset? - Yes, they are unique across chipset.
3. Which are tools required to retrieve certificate and private key (or private key reference)? - Please kindly have my first answer.

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[mukeshkumar_prajapati]

Hello @Kan_Li ,

Thanks for your reply,

Most of the queries are solved with your last reply but still some queries remain to be resolved.

You have mentioned that seTool will get private key reference from chip - that worked but se05x_GetCertificate - I could not test because it has not been compiled with my build set up and after checking I found that it will compile if I set "SSS_HAVE_HOSTCRYPTO_MBEDTLS: ON" but for my build set up we use "PTMW_HostCrypto=OPENSSL". could you please tell me how I can get se05x_GetCertificate compiled in my build setup.

Thanks,

Mukesh Prajapati

[Kan_Li]

Hello @mukeshkumar_prajapati ，

This demo works with MbedTSL only, if you use openSSL instead, you may use the ssscli tool.

Please refer to SE-PLUG-TRUST-MW_04.07.00/simw-top/doc/cli-tool.html for more details.

Hope that helps,

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

[Kan_Li]

Hi @mukeshkumar_prajapati ,

There are demo/tools available for that purpose, please kindly refer to the following for details.

SE-PLUG-TRUST-MW_04.07.00/simw-top/doc/demos/se05x/se05x_GetCertificate/Readme.html

SE-PLUG-TRUST-MW_04.07.00/simw-top/doc/demos/se05x/seTool/Readme.html

Hope that helps,

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------