Skip to content

feat: tedge cert create-key command #3709

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 12 commits into
base: main
Choose a base branch
from
Draft

feat: tedge cert create-key command #3709

wants to merge 12 commits into from

Conversation

Bravo555
Copy link
Contributor

@Bravo555 Bravo555 commented Jun 26, 2025 •
edited
Loading

TODO

  • handle all supported keys (EC 256/384, RSA 2048/3072/4096)
  • allow selecting token, key label, key type and size using command line arguments
  • write a test to maintain compatibility with 1.5.1
  • how to switch to using the new key
  • show more information after key is created
  • test failure modes
  • see if we can remove added dependencies
  • cleanup

Proposed changes

Implements a tedge cert create-key command that can be used to create a private key on a PKCS11 token without additional tools.

Types of changes

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Improvement (general improvements like code refactoring that doesn't explicitly fix a bug or add any new functionality)
  • Documentation Update (if none of the other choices apply)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Paste Link to the issue

#3665

Checklist

  • I have read the CONTRIBUTING doc
  • I have signed the CLA (in all commits with git commit -s. You can activate automatic signing by running just prepare-dev once)
  • I ran just format as mentioned in CODING_GUIDELINES
  • I used just check as mentioned in CODING_GUIDELINES
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)

Further comments

@Bravo555 Bravo555 requested a deployment to Test Pull Request June 26, 2025 08:58 — with GitHub Actions Waiting
@Bravo555 Bravo555 linked an issue Jun 26, 2025 that may be closed by this pull request
tedge cert create should support creating a key via the tedge-p11-server #3665
Open
@Bravo555 Bravo555 self-assigned this Jun 26, 2025
@codecov Codecov
Copy link

codecov bot commented Jun 26, 2025 •
edited
Loading

Codecov Report

Attention: Patch coverage is 8.73016% with 115 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
...ates/extensions/tedge-p11-server/src/pkcs11/mod.rs 0.00% 64 Missing ⚠️
crates/extensions/tedge-p11-server/src/client.rs 36.66% 12 Missing and 7 partials ⚠️
...rates/core/tedge/src/cli/certificate/create_key.rs 0.00% 16 Missing ⚠️
crates/extensions/tedge-p11-server/src/server.rs 0.00% 14 Missing ⚠️
crates/core/tedge/src/cli/certificate/cli.rs 0.00% 1 Missing ⚠️
crates/extensions/tedge-p11-server/src/service.rs 0.00% 1 Missing ⚠️

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from 7d44718 to c2e2aa1 Compare June 27, 2025 07:55
@Bravo555 Bravo555 requested a deployment to Test Pull Request June 27, 2025 07:56 — with GitHub Actions Waiting
@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from c2e2aa1 to 993fd82 Compare June 27, 2025 17:57
@Bravo555 Bravo555 requested a deployment to Test Pull Request June 27, 2025 17:57 — with GitHub Actions Waiting
@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from 993fd82 to 64f3a6b Compare June 30, 2025 17:06
@Bravo555 Bravo555 requested a deployment to Test Pull Request June 30, 2025 17:06 — with GitHub Actions Waiting
@reubenmiller reubenmiller added the theme:hsm Hardware Security Module related topics label Jul 3, 2025
@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from 64f3a6b to 525651b Compare July 4, 2025 13:10
@Bravo555 Bravo555 requested a deployment to Test Pull Request July 4, 2025 13:10 — with GitHub Actions Waiting
@Bravo555 Bravo555 temporarily deployed to Test Pull Request July 9, 2025 16:23 — with GitHub Actions Inactive
@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from 3025528 to c638b40 Compare July 10, 2025 07:52
@Bravo555 Bravo555 temporarily deployed to Test Pull Request July 10, 2025 07:52 — with GitHub Actions Inactive
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jul 10, 2025 •
edited
Loading

Robot Results

✅ Passed ❌ Failed ⏭️ Skipped Total Pass % ⏱️ Duration
664 2 3 666 99.70 1h49m22.68817s

Failed Tests

Name Message ⏱️ Duration Suite
Remote access session is independent from mapper (when using socket activation) Failed to connect via remote access. stdout: <<EOT EOT stderr <<EOT Starting external command on 3020085491 (https://qaenvironment.eu-latest.cumulocity.com) Bad packet length 1397966893. ssh_dispatch_run_fatal: Connection to 127.0.0.1 port 46547: message authentication code incorrect Duration: 1.326s 2025-07-15T11:24:46.574Z ERROR commandError: exit status 255 EOT 18.725 s Test Remote Access
Can create a private key on the PKCS11 token and download new cert from c8y 'Certificate request self-signature verify failure ' does not contain 'Certificate request self-signature verify OK' 2.871 s Private Key Storage

@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from c638b40 to c3959cd Compare July 11, 2025 08:49
@Bravo555 Bravo555 temporarily deployed to Test Pull Request July 11, 2025 08:49 — with GitHub Actions Inactive
@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from c3959cd to e099533 Compare July 14, 2025 14:31
@Bravo555 Bravo555 temporarily deployed to Test Pull Request July 14, 2025 14:31 — with GitHub Actions Inactive
@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from e099533 to fef773e Compare July 14, 2025 14:36
@Bravo555 Bravo555 temporarily deployed to Test Pull Request July 14, 2025 14:36 — with GitHub Actions Inactive
@Bravo555 Bravo555 requested a deployment to Test Pull Request July 14, 2025 15:13 — with GitHub Actions Waiting
@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from 25fe73f to 629ccbe Compare July 14, 2025 15:16
@Bravo555 Bravo555 temporarily deployed to Test Pull Request July 14, 2025 15:16 — with GitHub Actions Inactive
@Bravo555 Bravo555 temporarily deployed to Test Pull Request July 15, 2025 09:00 — with GitHub Actions Inactive
@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from 4ce401c to f62d5d0 Compare July 15, 2025 11:10
@Bravo555 Bravo555 temporarily deployed to Test Pull Request July 15, 2025 11:10 — with GitHub Actions Inactive
@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from f62d5d0 to 3281dca Compare July 16, 2025 09:26
@Bravo555 Bravo555 requested a deployment to Test Pull Request July 16, 2025 09:26 — with GitHub Actions Waiting
Bravo555 added 12 commits July 16, 2025 10:02
@Bravo555
fix wrong csr
7944a8c 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
Add tedge cert create-key command
4785fd0 
The command uses TedgeP11Client to create a new RSA keypair on the
PKCS11 token.

Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
refactor: TedgeP11Client extract request submission
8b1ef55 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
Set RSA key size and label
76181c3 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
Creating EC keys
baa66eb 
Added options to create EC keys, however there remains a problem that
p11tool doesn't display curve names as it does with keys generated with
`p11tool --generate-privkey`.

Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
Return DER of public key from create_key
5cf5427 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
working tedge cert download with CSR signed by PCKS 11 token
9cac5be 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
working ecdsa keys
5aa4980 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
fix maintain 1.5.1 compatibility
2bc4fd8 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
resloved RUSTSEC-2023-0071
8406635 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
remove unnecessary deps
7184e35 
Signed-off-by: Marcel Guzik <marcel.guzik@cumulocity.com>
@Bravo555
fixup! resloved RUSTSEC-2023-0071
1aa5da4
@Bravo555 Bravo555 force-pushed the feat/pkcs11-create-key branch from 3281dca to 1aa5da4 Compare July 16, 2025 10:02
@Bravo555 Bravo555 requested a deployment to Test Pull Request July 16, 2025 10:02 — with GitHub Actions Waiting
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@didier-wenzek didier-wenzek Awaiting requested review from didier-wenzek didier-wenzek will be requested when the pull request is marked ready for review didier-wenzek is a code owner

@albinsuresh albinsuresh Awaiting requested review from albinsuresh albinsuresh will be requested when the pull request is marked ready for review albinsuresh is a code owner

@jarhodes314 jarhodes314 Awaiting requested review from jarhodes314 jarhodes314 will be requested when the pull request is marked ready for review jarhodes314 is a code owner

@rina23q rina23q Awaiting requested review from rina23q rina23q will be requested when the pull request is marked ready for review rina23q is a code owner

@reubenmiller reubenmiller Awaiting requested review from reubenmiller reubenmiller will be requested when the pull request is marked ready for review reubenmiller is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

@Bravo555 Bravo555

Labels
theme:hsm Hardware Security Module related topics
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

tedge cert create should support creating a key via the tedge-p11-server
2 participants
@Bravo555 @reubenmiller