This example shows all steps for an onboarding process of a device to AWS IoT Core using the pre-provisioned credentials of the EdgeLock SE050E secure element.
AWS IoT authenticates client certificates using the TLS protocol's client authentication mode. In TLS client authentication, AWS IoT requests an X.509 client certificate and validates the certificate's status against a registry of certificates in the AWS account. It challenges the client for proof of ownership of the private key that corresponds to the public key contained in the certificate.
The secure element EdgeLock SE050E is used to securely store the private client keys and perform the client authentication.
AWS IoT supports these types of X.509 client certificates, all are supported by EdgeLock SE050E:
Only Option 3 supports the onboarding process of a device to AWS IoT Core using pre-provisioned credentials of a generic EdgeLock SE050. This option is known as “AWS IoT Core Multi-Account Registration” and is supported by the AWS CLI interface. Customer-specific configurations of EdgeLock SE050E can even use Option 2 with pre-provisioned certificates.
The following hardware will be used for this demo:
 .. For further details see NXP “AN12570 Quick start guide with Raspberry Pi” chapter “2 Prepare your Raspberry Pi”. In the following sections, we will use the OM-SE050RPI adapter board.
Make sure the jumpers in your OM-SE050ARD-E board are configured as shown in the figure below (equal to the default configuration of OM-SE050ARD-E
Stack the OM-SE050ARD-E with the adapter board to the Raspberry Pi
This section explains how to get your Raspberry Pi ready to execute the EdgeLock SE050 Plug & Trust middleware.
Enable I2C if not yet enabled on your Raspberry Pi.
If does not list i2c-1, I2C needs to be enabled for your board.
Use the down arrow to select Interfacing Options. Follow instructions and Enable I2C.
Create a new folder called se_mw:
Install the required build tools, if the image does not have them already.
Download the EdgeLock SE05x Plug & Trust middleware (nxp.com login needed) from the NXP website .
Unzip the EdgeLock SE05x Plug & Trust middleware in the se_mw folder:
Run the following commands to build OpenSSL engine for SE050. For further details see please “AN12570 Quick start guide with Raspberry Pi” chapter “4.1 Example: SE050E CMake build settings”. If the hostname is “raspberrypi” automatically the config for a Raspberry Pi is created:
Update the CMake settings as shown in the figure below. Press first the Configure button and
second the Generate button and close the CMake GUI.
In this example, the SE050 Python-based ssscli tool is used to extract the credentials of the EdgeLock SE050. The following steps are needed before running the ssscli tool and needed
are needed once per installation:
To install ssscli tool, run the following commands once:
To install the AWS CLI tool, run the following commands once:
Add AWS CLI executable to your Command-Line Path:
Confirm the AWS CLI tool was successful installed:
When you first create an AWS account, you begin with a single sign-in identity that has complete access to all AWS services and resources in the account. This identity is called the AWS account root user. Amazon strongly recommend that you do not use the root user for your everyday tasks, even the administrative ones. Instead, it is recommended to create an IMA user. Please read the following documentation for more details: What is IAM? - AWS Identity and Access Management (amazon.com)
Perform the following steps to create an IAM (Identity and Access Management) user.
You can save your frequently used configuration settings and credentials in files that are maintained by the AWS CLI.
Run the following command to quickly set your credentials, region, and output format:
We will be using ECC credentials in this example, the key with ID 0xF0000100 and the corresponding certificate at ID 0xF0000101. You can use any of the available certificates that are pre-provisioned in your EdgeLock SE050E. Please refer to AN12436 - SE050 Configurations for a list of available key and certificate IDs.
Create a folder to store the EdgeLock SE050 credentials:
Using pySSSCLI Tool, read out the device certificate.
The Certificate/Public Key as read from the Secure Element can be inserted into the OpenSSL key structure. The x509 OpenSSL command also supports to display the public keys contents:
openssl x509 -noout -text -in se050_device_cert0_ecc.cer
OpenSSL requires a key pair, consisting of a private and a public key, to be generated or loaded into the EdgeLock SE050E before the cryptographic operations can be executed.
Private Key: The Private key is securely stored inside the SE050E Secure Element and cannot be retrieved by the OpenSSL engine.
Reference Key: Standard OpenSSL API needs to be called with a key. Instead of a real private key the OpenSSL key data structure gets used with a reference to the private key inside the SE050E Secure Element. The reference key looks for OpenSSL like a real key, but it does not contain secret data.
Using pySSSCLI Tool, read out the device reference key.
In the first glance, the reference key looks like as any other private key, therefore it is
required to use OpenSSL to display the details:
openssl ec -in se050_device_key_ref0_ecc.pem -text
Use the AWS CLI Tool to register the extracted device certificate on to your AWS IoT Console.
The command line options are:
Execute the following command:
This command returns the certificate ANR and ANR ID. A certificate Amazon Resource Name (ARN) uniquely identifies this certificate. You can open the AWS IoT console to check if the certificate was successfully registered.
Note: You need to select the correct AWS region.
First, create a JSON document “se050_raspi_policy.json” with the following content.
Note: this policy allows for demo purpose access to all IoT actions on all resources.
using for example the nano editor. The following command creates an empty file.
Copy & Paste the content into the text editor and save the file.
Use the AWS CLI Tool to create the policy on your AWS IoT Console.
You can open the AWS IoT console to check if the policy was successfully created.
Attaching an AWS IoT Core policy to a certificate gives the device connecting with this certificate the permissions specified in the policy.
Use the AWS CLI Tool to attach the policy to the device certificate.
Run the following command to print out your AWS’ user’s endpoint address. This will be used later:
Alternative you can obtain the customer AWS IoT endpoint using the AWS IoT console.
Navigate to demos se_mw/simw-top/demos/linux/aws_eou directory and execute the buildScript.sh. This will build the project iot_demo_mqtt.
Copy all SE50 credentials into the example output/bin folder:
To let openSSL use the engine set the openssl config path to point to the preconfigured config file:
Navigate to demos binary folder:
Run the demo with specifying your endpoint URL and certificate + key files:
Go to the AWS IoT Core dashboard and subscribe to the following topic:
The MQTT topic you subscribed will now appear in the Subscriptions section as
shown in the figure below in case your run the demo again.