[Technical Question] Need clairty on using leaf certificates for device authentication stored in secure element NXP SE050

[hassan-xy]

Hi,
I need clarity on understanding how I can use leaf certificates stored in my secure element for connection to azure dps.
I am using register_x509.js sample to connect to azure and noticed that private key stored in secure element cant be read out to connect with the azure dps. Then how do I use the register_x509.js code? Is there an alternate approach to connect with the dps?
Please help me in solving this issue.

My build system: Linux yocto dunfell (3.1.11)
My kernel version: 5.15
My nodejs version: node14
openssl version: 1.1.1

Let me know if anything else is needed.

Regards,
Hassan

[lev-i]

Have you tried adding your engine_id to the deviceCert section of the sample?

  cert: fs.readFileSync(process.env.CERTIFICATE_FILE).toString(),
  key: fs.readFileSync(process.env.KEY_FILE).toString()
  clientCertEngine: xx

It should directly reference the engine_id listed in your openssl.cnf file. The tls options are already exposed in authorization.ts, so you want to get OpenSSL to route calls from the tls layer to the specified engine.

Unless I'm misunderstanding and you specifically want to be using dps? Let me know.

[hassan-xy]

Hi @lev-i
Thanks for the comment.
I was able to fix the issue. And yes you are right, we need to make sure that all the crypto operations occur inside the secure element. For the we need to export the openssl_conf flag to use NXP secure engine for crypto operations.

Thanks,
Hassan