I have the following scenario: I have a lot of embedded devices that should talk to another. To enable trust between these devices I would like to use certificates. The devices generate a keypair and send the public key to a central instance that should act as enrollment agent, request the corresponding certificate for the public key from the CA and send it back to the client.
To my limited understanding it should be possible to request a certificate for another user/machine if
a) I'm in possession of an enrollment agent certificate, with which I sign the request
b) I have the public key that should be certified by the CA.
Unfortunately everything I found during my research the last days this does not seem to be possible. Can somebody with a deeper understanding than me please shed some light on this?
To make it clearer what I want to achieve and still not know if it's possible, here are the steps:
- The device creates a keypair
- The device sends the public key of this pair to a machine that acts as an enrollment agent (protected by OTP)
- The machine, that acts as enrollment agent, creates a csr for the device containing the public key and signs it with the enrollment agent certificate.
- The machine sends the csr to the RA and delivers the resulting certificate to the device.
I hope this clears things up a bit.
The first thing I researched was the automation of the process by using certreq, especially certreq -new. I can see no option to provide the public key of the device to the request.
Then I looked at the example at Creating an Enrollment Agent Signed CMC Request (Single Signer), but I can't see where the public key of the device makes its way into the request.
As I am more familiar with the Java language I also looked in some examples utilizing the bouncycastle API. All of them used the private key corresponding to the public key of the device to sign the request, not the enrollment agent certificate.
I know that the above is a common usecase for smartcards, but I can't find how it is done.