What is the proper certificates configuration for NervesHub 2.0 and NervesHubLink?

[ivanhercaz]

@jjcarstens

You do still need the cacertfile.

The error persists.

@jjcarstens

I’m assuming since these are paths to files that you are trying to run NervesHubLink on host? Or are you making firmware and putting this on device?

I am running this on my local machine but not with MIX_TARGET=host, I specify my target, because if not I get ** (Mix) The task "nerves_hub.ca_certificate" could not be found, what I don’t understand because nerves_hub_link is not marked with the targets key, so the tasks of NervesHubCLI derived from NervesHubLink should be available in whatever target I set, no?

Edit

I think I may still not understanding what cacerts should have, at least reading this:

@jjcarstens

Here’s a little visual breakdown of what is needed in the cacerts of the request:

[
  device_signer_ca, # For Client -> Server (client-side SSL)
  NervesHub-root-ca, # For Server -> Client  (server-side SSL)
  NervesHub-server-ca, # For Server -> Client  (server-side SSL)
  NervesHub-device-ca, # For Server -> Client  (server-side SSL)
]

On Device won't handshake with nerves-hub using nerves_hub_link - #8 by jjcarstens.

Edit
I think my problem is with the castorefile, because if I am not wrong, this CA must have the root ca certificate and the certificates for nerveshub.DOMAIN.EXT, but in my ca.pem there is only one certificate.

I need to review it with patience and I may be need to restart the generation of the certificates in the server, because it is possible that I type something wrong.

One doubt I have with the openssl commands I posted in the first post:

$ openssl genrsa -out ca.key 2048
$ openssl req -x509 -new -nodes -key ca.key -sha256 -days 1825 -out ca.pem -subj '/OU=NervesHub/'
$ openssl genrsa -out device.nerves-hub.org-key.pem
$ openssl req -new -key device.nerves-hub.org-key.pem -out device.nerves-hub.org.csr -subj '/CN=device.nerves-hub.org/'
$ nvim device.nerves-hub.org.ext
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names

[alt_names]
DNS.1 = device.nerves-hub.org
$ openssl x509 -req -in device.nerves-hub.org.csr -CA ca.pem -CAkey ca.key -CAcreateserial -out device.nerves-hub.org.pem -days 825 -sha256 -extfile device.nerves-hub.org.ext
$ sudo mv device.nerves-hub.org-key.pem /etc/ssl/
$ sudo mv device.nerves-hub.org.pem /etc/ssl/

In the commands we use device.nerves-hub.org, what I replaced by device.nerveshub.DOMAIN.EXT, and the ca.pem I am using in my configuration is the one that is returned by the second openssl command:

$ openssl req -x509 -new -nodes -key ca.key -sha256 -days 1825 -out ca.pem -subj '/OU=NervesHub/'

So I do not rule out the possibility that I am confusing the file.