wifi: enterprise: Add support for runtime certificates #87656

krish2718 · 2025-03-25T19:33:18Z

Implements #79564

Move enterprise configs to a snippet
Add TLS credentials configs to the new snippet
Implement runtime certificate management using TLS credentials module
Fix a bug in TLS credentials shell

The certificate installation is handled by a helper script which simplifies installation process, but even without that PR cred shell can be used manually but it's cumbersome.

krish2718 · 2025-03-26T20:08:45Z

@MaochenWang1 I have not done any AP mode testing on this as nRF70 doesn't support AP + Enterprise mode, it would e good if NXP can do some tests.

MaochenWang1 · 2025-03-27T11:16:51Z

@MaochenWang1 I have not done any AP mode testing on this as nRF70 doesn't support AP + Enterprise mode, it would e good if NXP can do some tests.

Sure, will review, test and feedback

krish2718 · 2025-03-27T11:50:23Z

@MaochenWang1 I have not done any AP mode testing on this as nRF70 doesn't support AP + Enterprise mode, it would e good if NXP can do some tests.

Sure, will review, test and feedback

FYI, I am seeing issues even with build time certs, debugging now will push fixes soon.

subsys/net/l2/wifi/wifi_shell.c

subsys/net/lib/tls_credentials/tls_credentials_shell.c

subsys/net/l2/wifi/CMakeLists.txt

samples/net/wifi/test_certs/install_certs.sh

krish2718 · 2025-03-27T19:06:04Z

I have resolved the compliance except for below: I tried to get checkpatch ignore using --ignore FILE_PATH=a/samples/net/wifi/test_certs/ but looking at the perl script there is no such provision, it is trying to find typo in cert data :)

Running Checkpatch       tests in /home/tach/work/zephyr/zephyr ...
1 checks failed
ERROR   : Test Checkpatch failed: 
TYPO_SPELLING: 'jUs' may be misspelled - perhaps 'just'?
File:samples/net/wifi/test_certs/rsa2k/server.pem
Line:26

Complete results in compliance.xml

krish2718 · 2025-03-27T19:08:44Z

@MaochenWang1 I have not done any AP mode testing on this as nRF70 doesn't support AP + Enterprise mode, it would e good if NXP can do some tests.

Sure, will review, test and feedback

FYI, I am seeing issues even with build time certs, debugging now will push fixes soon.

Tested end-end, it is working fine.

doc/connectivity/networking/api/wifi.rst

subsys/net/l2/wifi/wifi_shell.c

nordicjm

Build system changes OK

samples/net/wifi/test_certs/install_certs.py

kartben · 2025-04-09T09:32:33Z

doc/connectivity/networking/api/wifi.rst

+To facilitate installation of the certificates, a helper script is provided in the ``samples/net/wifi/test_certs`` directory. The script can be used to install the certificates at runtime.

 .. code-block:: bash

-    $ west build -p -b <board> samples/net/wifi -- -DEXTRA_CONF_FILE=overlay-enterprise-variable-bufs.conf
+    $ samples/net/wifi/test_certs/install_certs.py -p samples/net/wifi/test_certs/rsa2k

+The script will install the certificates in the ``rsa2k`` directory to the TLS credentials store in the device over UART and using TLS credentials shell commands.


so all devices are supporting the AT commands this tool seems to be using?

This doesn't use AT command, but TLS credentials shell (part of Zephyr)

kartben · 2025-04-09T09:33:48Z

doc/connectivity/networking/api/wifi.rst

+Compile time certificates
+-------------------------
+
+Test certificates in PEM format are committed to the repo at :zephyr_file:`samples/net/wifi/test_certs` and the during the


really not a fan of the proliferation of binary certificates in-tree. Can't we just have instructions on what steps people sjhould take to generate them? It seems to me as this would be much more useful, too.

Sure, but for a quick testing it's useful to have a golden certs that just work. Else any mistakes in cert generation are tough to debug.

We definitely need a tested set of ready made certificates in the samples, otherwise it is difficult to verify things automated way. We certainly can/should have also instructions how the user can generate them too.

We certainly can/should have also instructions how the user can generate them too.

I have already added a link to the script that I had used to generate these certs in the wifi docs: (https://docs.zephyrproject.org/latest/connectivity/networking/api/wifi.html#wi-fi-enterprise-test-x-509-certificate-header-generation)

Sure, but for a quick testing it's useful to have a golden certs that just work. Else any mistakes in cert generation are tough to debug.

Sorry but I still don't get why it's not possible to generate the certificates on the fly? Should be a few dozen lines of code using Python's cryptography package, I think? And this would have the merit to actually provide more guidance to the end user.

Also, where are these certificates coming from and are we even allowed to redistribute them (I wouldn't be surprised if they are part of some kind of Wi-Fi Alliance certification suite and not meant to be accessed by non-members ...)?

$ openssl x509 -in client.pem -text -noout Certificate: Data: Version: 3 (0x2) Serial Number: 97:d4:07:ec:a6:05:15:13 Signature Algorithm: sha384WithRSAEncryption Issuer: C=US, L=Santa Clara, O=Wi-Fi Alliance, CN=Suite B RSA 3k Root CA ...

why do they appear to be issued by Wi-Fi Alliance then?

Sorry, I am missing something. Where is Wi-Fi alliance coming from? The issuer is Example certificate authority, no?

Not for the rsa3k certs, no, and I have concerns these can't be redistributed outside of Wi-Fi Alliance certification program. This does need to be clarified.

Ah thanks, I understand the confusion now, I was looking the ones that I have added in this PR. The WFA ones are existing ones already in main I have just moved them to rsa3k directory, they are submitted by NXP. + @MaochenWang1 @fengming-ye can you please respond to Ben's question about redistributing those certs in Zephyr?

@kartben the Wi-Fi alliance certs are already in main and this PR is just moving them around. I suggest that we deal the cert distribution issue and possible removal from zephyr main in a separate PR.

@jukka could you please create a tracking issue for this redistribution license problem, so we ensure that this is resolved ASAP?

create a tracking issue for this redistribution license problem, so we ensure that this is resolved ASAP?

Sure, it is here #88771

krish2718 · 2025-04-10T20:12:27Z

@kartben please review my responses, thanks.

Using TLS credentials library add support for run-time certificates where the installed certs are retrieved from the credential store (as of now only volatile backend is tested). This helps in production environments. Implements zephyrproject-rtos#79564. Signed-off-by: Chaitanya Tata <[email protected]>

The volatile backend stores the credentials on the heap, so, explicitly add a config option that can be overridden in case there are more certs than the default. Signed-off-by: Chaitanya Tata <[email protected]>

Instead of having an overlay move the Enterprise configurations to a dedicated snippet so that it can be enabled with any sample. Can be used along with Wi-Fi snippet e.g., `-S "wifi-ipv4;wifi-enterprise"`. Signed-off-by: Chaitanya Tata <[email protected]>

Enable TLS credentials shell to manager Wi-Fi enterprise certs. Signed-off-by: Chaitanya Tata <[email protected]>

Deletion of credential should use the pointer from the reference slot not the temporary buffer, this causes a crash (unknown error). Signed-off-by: Chaitanya Tata <[email protected]>

Certificates usage depends on STA/AP mode, but we don't have that information at a build time, so, make all certs as optional and if a file isn't found then generate an empty header so that corresponding C code will be built. Any missing mandatory certificates will be validated before connection and connection is failed. Signed-off-by: Chaitanya Tata <[email protected]>

RSA3K based certs are not supported on all platforms, so, keep both variants, rsa2k (the older certs but with longer expiry 9999 days) and rsa3k (latest ones) and we can have more variants in this folders. Also, add a cmake variable to override the path with default as rsa3k. Signed-off-by: Chaitanya Tata <[email protected]>

The command should work with existing certs rather than a generic example, also fix the key-management. Signed-off-by: Chaitanya Tata <[email protected]>

This is needed to ensure run-time certs feature builds. Signed-off-by: Chaitanya Tata <[email protected]>

Dismissing my request for changes since apparently there is pressure for being able to merge this "downstream" and I am obviously getting in the way.

the Wi-Fi alliance certs are already in main and this PR is just moving them around

This is potentially a serious issue, so I am not sure I understand the "let's pretend it's ok (and it might very well be, don't get me wrong) and let's just deal with it later".

krish2718 force-pushed the wifi_ent_rejig branch 2 times, most recently from 37adaa1 to c167779 Compare March 26, 2025 20:01

krish2718 marked this pull request as ready for review March 26, 2025 20:02

krish2718 changed the title ~~wifi: Enterprise security rejig~~ wifi: enterprise: Add support for runtime certificates Mar 26, 2025

github-actions bot added area: Networking area: Build System area: Wi-Fi Wi-Fi area: Samples Samples labels Mar 26, 2025

github-actions bot requested review from jukkar, kartben, MaochenWang1, nashif, nordicjm and tejlmand March 26, 2025 20:02

github-actions bot assigned jukkar Mar 26, 2025

krish2718 force-pushed the wifi_ent_rejig branch from c167779 to ee1ba90 Compare March 27, 2025 13:44

jukkar reviewed Mar 27, 2025

View reviewed changes

krish2718 force-pushed the wifi_ent_rejig branch from ee1ba90 to 52257b7 Compare March 27, 2025 19:08

krish2718 force-pushed the wifi_ent_rejig branch from 52257b7 to 07de5fe Compare March 27, 2025 20:13

kartben reviewed Mar 28, 2025

View reviewed changes

doc/connectivity/networking/api/wifi.rst Outdated Show resolved Hide resolved

jukkar reviewed Mar 28, 2025

View reviewed changes

subsys/net/l2/wifi/wifi_shell.c Outdated Show resolved Hide resolved

subsys/net/l2/wifi/wifi_shell.c Outdated Show resolved Hide resolved

subsys/net/l2/wifi/wifi_shell.c Outdated Show resolved Hide resolved

subsys/net/l2/wifi/wifi_shell.c Outdated Show resolved Hide resolved

krish2718 force-pushed the wifi_ent_rejig branch from 07de5fe to ee8a511 Compare March 28, 2025 12:57

jukkar previously approved these changes Mar 28, 2025

View reviewed changes

krish2718 requested review from sachinthegreen and rlubos March 29, 2025 14:50

jukkar previously approved these changes Apr 8, 2025

View reviewed changes

nordicjm previously approved these changes Apr 9, 2025

View reviewed changes

kartben previously requested changes Apr 9, 2025

View reviewed changes

krish2718 requested a review from kartben April 10, 2025 10:17

krish2718 dismissed stale reviews from nordicjm, jukkar, sachinthegreen, MaochenWang1, and rlubos via 3d2d415 April 11, 2025 13:09

krish2718 force-pushed the wifi_ent_rejig branch 4 times, most recently from 37878ea to 7cf172b Compare April 16, 2025 12:25

krish2718 added 9 commits April 17, 2025 16:17

net: lib: tls_credentials_shell: Add a config for heap

4c17ef5

The volatile backend stores the credentials on the heap, so, explicitly add a config option that can be overridden in case there are more certs than the default. Signed-off-by: Chaitanya Tata <[email protected]>

snippets: wifi-enterprise: Add support for TLS credentials

05b0280

Enable TLS credentials shell to manager Wi-Fi enterprise certs. Signed-off-by: Chaitanya Tata <[email protected]>

net: lib: tls_credentials_shell: Fix crash during delete

f3f3d80

Deletion of credential should use the pointer from the reference slot not the temporary buffer, this causes a crash (unknown error). Signed-off-by: Chaitanya Tata <[email protected]>

doc: net: wifi: Fix the connect command

2651d66

The command should work with existing certs rather than a generic example, also fix the key-management. Signed-off-by: Chaitanya Tata <[email protected]>

tests: net: wifi: Add a test for Enterprise with run-time certs

9d1e159

This is needed to ensure run-time certs feature builds. Signed-off-by: Chaitanya Tata <[email protected]>

krish2718 force-pushed the wifi_ent_rejig branch from 7cf172b to 9d1e159 Compare April 17, 2025 10:47

jukkar approved these changes Apr 17, 2025

View reviewed changes

rlubos approved these changes Apr 17, 2025

View reviewed changes

jukkar mentioned this pull request Apr 17, 2025

Wi-Fi certificate re-distribution #88771

Open

kartben merged commit 7f7965e into zephyrproject-rtos:main Apr 17, 2025
25 checks passed

krish2718 linked an issue Apr 17, 2025 that may be closed by this pull request

wifi: Use TLS credentials library for 802.1x certificates #79564

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

wifi: enterprise: Add support for runtime certificates #87656

wifi: enterprise: Add support for runtime certificates #87656

krish2718 commented Mar 25, 2025 •

edited

Loading

krish2718 commented Mar 26, 2025

MaochenWang1 commented Mar 27, 2025

krish2718 commented Mar 27, 2025

krish2718 commented Mar 27, 2025 •

edited

Loading

krish2718 commented Mar 27, 2025

nordicjm left a comment

kartben Apr 9, 2025

krish2718 Apr 9, 2025

kartben Apr 9, 2025

krish2718 Apr 9, 2025

jukkar Apr 14, 2025

krish2718 Apr 14, 2025

kartben Apr 17, 2025

kartben Apr 17, 2025

krish2718 Apr 17, 2025

jukkar Apr 17, 2025

carlescufi Apr 17, 2025

jukkar Apr 17, 2025

krish2718 commented Apr 10, 2025

wifi: enterprise: Add support for runtime certificates #87656

wifi: enterprise: Add support for runtime certificates #87656

Conversation

krish2718 commented Mar 25, 2025 • edited Loading

krish2718 commented Mar 26, 2025

MaochenWang1 commented Mar 27, 2025

krish2718 commented Mar 27, 2025

krish2718 commented Mar 27, 2025 • edited Loading

krish2718 commented Mar 27, 2025

nordicjm left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

krish2718 commented Apr 10, 2025

krish2718 commented Mar 25, 2025 •

edited

Loading

krish2718 commented Mar 27, 2025 •

edited

Loading