Hardware Security Module (HSM) Compatible with Cumulocity CA?

[SeanThomas11]

Is the Hardware Security Module (HSM) in a RevPi compatible with Cumulocity CA? If so, please provide documentation for enabling this functionality.

[reubenmiller]

Is the Hardware Security Module (HSM) in a RevPi compatible with Cumulocity CA? If so, please provide documentation for enabling this functionality.

To be honest I'm not 100% sure. Do you know what kind of HSM they have? Is it TPM 2.0?

The thin-edge.io pre-requisite is that the HSM needs to have a PKCS#11 interface (on linux this will be an .so file somewhere).

[reubenmiller]

I just did my own research. I'm guessing you're talking about the RevPi Connect 4/5? If so, it seems that has a TPM 2.0 module (Infineon OPTIGA™ TPM SLB 9670). Assuming that the RevPi OS has the tpm2-pkcs11 package installed, then it should work fine as I have used the same TPM 2.0 chip on my personal Raspberry Pi.

The HSM setup can be a bit tricky if you haven't done anything with it in the past, but we can see if we can put together a guide for you.

[SeanThomas11]

Thanks @reubenmiller! Yes, we're building on the RevPi Connect 5 with the TPM 2.0 module and the tpm2-pkcs11 apt package installed.

[reubenmiller]

Thanks @reubenmiller! Yes, we're building on the RevPi Connect 5 with the TPM 2.0 module and the tpm2-pkcs11 apt package installed.

And you'll also need the latest thin-edge.io, 1.6.1 for all of this to work.

[SeanThomas11]

Absolutely, we're running 1.6.1. Looking forward to the next feature release too!

[reubenmiller]

We have added a helper script as part of the thin-edge.io Rugix integration which should do most of your setup for you.

This script isn't part of the core product as we're currently working on making it easier by removing the dependency on p11tool (currently used for the initial key creation). It hasn't been extensively tested, but it should be helpful (though it is fairly long as there are a lot of steps).

If you run into any problems then it might be easier to have an interactive session. There are a lot of configuration options, so I would encourage you to read help (--help) as there are some additional options that can be defined that aren't explicitly mentioned in the guide below.

Pre-requisites

You need to have the following command and files available (we're hoping to remove the first two pre-requisites in a future tedge release)

• p11tool
• certtool (typically in gnutls-bin in Debian)
• libtpm2_pkcs11.so (typically stored under /usr/lib)

Enrolling the device

1. Download the helper script (and inspect it)

   wget -O - https://raw.githubusercontent.com/thin-edge/tedge-rugix-core/refs/heads/v0.8-rugix/recipes/setup-pkcs11/files/init-pkcs11.sh > init-pkcs11.sh
   
   chmod +x init-pkcs11.sh

   You can view the help using:

   ./init-pkcs11.sh --help

2. Get the pkcs11 uri for the empty slot of the TPM2.0

3. Initialize the TPM 2.0 and setup thin-edge.io and enroll the device with Cumulocity using the Cumulocity CA

   sudo -u tedge ./init-pkcs11.sh \
       --type tpm2 \
       --create \
       --device-id "mytedge01" \
       --c8y-url example.c8y.io \
       --pin 12345 \
       --so-pin 12345678 \
       --token-url 'pkcs11:model=SLB9672%00%00%00%00%00%00%00%00%00;manufacturer=Infineon;serial=0000000000000000;token='

   Note: You may need to change the token-url to suite the specific TPM2.0 PKCS11 URI related to the "blank slot".

   The above should do the following:

   • Create a new TPM 2.0 slot
   • Configure and start the tedge-p11-server for usage with the TPM2.0 (as the TPM2_PKCS11_STORE environment variable needs to be set)
   • Set the c8y.url
   • Create a CSR, then try to download the certificate from Cumulocity (it will print a URL on the console that you can copy/paste into a browser)

Renewing an existing device certificate

The certificate renewer service should work out of the box, however you should be able to do a renewal using the following command:

sudo tedge cert renew c8y && sudo tedge reconnect c8y

[reubenmiller]

Note: The official guide also has some useful information, https://thin-edge.github.io/thin-edge.io/references/hsm-support/#step-2-tedge-setup, but TPM 2.0 modules require some additional steps (more to do how TPM 2.0's work, rather than something thin-edge.io specific).

But the idea is that once the private key creation can also be done via tedge, it will make writing the instructions much easier.