How to Use Secure Storage API in Edge?

0
Issue My container in Edge has to join the Bridge "proxy-redirect" in IED device and my container must be in same sub network with edge_iot_core. Am I right? How to use cert-chain in certsips.json? How could my container communicate with secure storage service with authentication success?   Desire I hope to use Edge Secure Storage API in my own container to save some data, and I ref the link below. https://docs.eu1.edge.siemens.cloud/apis_and_references/apis/api-how-tos/secure-storage.html https://docs.eu1.edge.siemens.cloud/apis_and_references/apis/ied/secure-storage-api.html   Steps I have configured my container network mode as bridge as the edge wiki said. My container network join the “proxy-redirect” from the edge device.  My container IP is in same network with edge container edge_iot_core. I could see the file "/var/run/edgedevice/certsips.json" in my container. # /var/run/devicemodel/edgedevice/certsips.json { "auth-api-path":"a.service/api/v3", "cert-chain":"LS0tLS1CRU........", "edge-ips":"10.11.78.33", "secure-storage-api-path":"/device/edge/iert/api/v1/secure-storage" } I have put the filed cert-chain from certsips.json in cacert.crt file, such as the format below.                    6. My request code with python is below.               #!/usr/bin/env python # -*- coding: UTF-8 -*- import json import requests URL = "https://10.11.78.33/device/edge/iert/api/v1/secure-storage" HEAD = {'accept': '*/*', 'Content-Type': 'application/json'} response = requests.request("GET", (URL + "/keys"), headers=HEAD, cert="/root/cacert.crt", verify=True).json()          7. But some errors occurred to me. I think there maybe some issues about my .crt file, maybe the .crt file is not correct OR cert-chain is not supported in this usage. I am not sure.                Could you give me some ideas? Thanks~  
asked
1 answers
0

Hi Bao,
sorry for the delayed response. I now found time to take a look at the certificate handling. There are a few things you need to consider:

1. The provided "cert-chain" in the certsips.json file is a base64 encoded string which is a common way to provide certificates in config files. However to use them for SSL verification it needs to be decoded.
You can use the python base64 libary to do so:

 

# Decode the base64 certificate chain
cert_chain_base64 = data["cert-chain"]
cert_chain_bytes = base64.b64decode(cert_chain_base64)
cert_chain = cert_chain_bytes.decode('utf-8')  # Convert to string

 

After this you should have a cert chain that consists of 3 certifcates, looking like this:

 

-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIULkHBA6hievOxz9SEWGb922AlMo8wDQYJKoZIhvcNAQEL
...
p26kVxziN/bEVdPkF8EfcI6EVjSaGEDMc4ZdQ342TVVj1W5e4uGcgO1s+dtKU2nu
Pw==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIULkHBA6hievOxz9SEWGb922AlMo8wDQYJKoZIhvcNAQEL
...
p26kVxziN/bEVdPkF8EfcI6EVjSaGEDMc4ZdQ342TVVj1W5e4uGcgO1s+dtKU2nu
Pw==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIULkHBA6hievOxz9SEWGb922AlMo8wDQYJKoZIhvcNAQEL
...
p26kVxziN/bEVdPkF8EfcI6EVjSaGEDMc4ZdQ342TVVj1W5e4uGcgO1s+dtKU2nu
Pw==
-----END CERTIFICATE-----


2. The cert parameter of the request function is not used to provide a cert chain, but a client certificate. In this case you don't need to set it.

3. The verify parameter can be set to either a boolean, in which case it controls whether we verify the server's TLS certificate, or a string, in which case it must be a path to a CA bundle to use.
In our case we want to use the second option and set it to "verify=cert_chain"

I hope this solves your issues. Let me know if you have further questions.

Best
Johannes

 

answered