Get_cert did not obtain the latest cert_chain configuration from Set_cert.

[DYunkun]

When using spdm-emu, I successfully sent the set-cert command (ver 1.2, slot0) to the spdm-emu. I then wanted to verify that the cert_chain for slot0 had been updated by using get_cert. However, I found that the cert_chain returned by get_cert is still the original cert_chain, with no changes. I read CERT_INSTALL_RESET_CAP==0, expecting to get the latest cert_chain via get_cert. The get_cert responded successfully, but the cert_chain is not the one I set.
Is it a limitation of spdm-emu? Or am I misunderstanding the spec?
How can I get the latest cert_chain through get_cert?
I have uploaded the emu log.
Please help Clarify my doubts, Thanks.

log.txt

[steven-bellock]

Is it a limitation of spdm-emu?

libspdm itself does not automatically save the certificate chain, and relies on the Integrator to do that. See DMTF/libspdm#873.

Or am I misunderstanding the spec?

If CERT_INSTALL_RESET_CAP is not set, the specification is somewhat vague on whether the Requester can expect to retrieve the updated certificate chain immediately after SET_CERTIFICATE. Presumably it is up to the Responder implementer to specify any additional steps the Requester needs to do.

How can I get the latest cert_chain through get_cert?

spdm-emu would be enhanced to support this.

[DYunkun]

Thank you for your reply.
There is some confusion.
So in my scenario, spdm-emu is called Integrator？
DMTF/libspdm#873 still open. Is there a plan to complete it?

[steven-bellock]

So in my scenario, spdm-emu is called Integrator?

Correct.

DMTF/libspdm#873 still open. Is there a plan to complete it?

Probably to start, this could be "fixed" in spdm-emu. For libspdm that issue is fairly low priority, and we are currently focused on finishing SPDM 1.3 features.

[jyao1]

This is implemented in https://github.com/DMTF/libspdm/tree/main/os_stub/spdm_device_secret_lib_sample.

GetCert is to always read the sample cert (see https://github.com/DMTF/libspdm/blob/main/os_stub/spdm_device_secret_lib_sample/read_pub_cert.c),
while SetCert is saved as "slot_id_0_cert_chain.der" (see https://github.com/DMTF/libspdm/blob/main/os_stub/spdm_device_secret_lib_sample/set_cert.c)

@DYunkun, you are welcome to submit patch to improve the mechanism.