GCP IoT core rejects this RSA_PEM public key with an error

I try to develop an automation to register new IoT device with public RSA pem certificate but I have a problem which is I don't know the reason.

The problem is RSA_PEM public pem is generated my automation is rejected by GCP IoT Server with an error. That error is "The key data for the device credential in position 1 is invalid. Make sure the format is correct: Invalid RS256 public key"

When I debug the my code, the pem public certificate looks fine. But I am not sure that.

I am sharing go code that generate private and public certificates in paired.

package cert

import (
    "bytes"
    "crypto/rand"
    "crypto/rsa"
    "crypto/x509"
    "encoding/pem"

    "io"
)

type CertificateRSA struct {
    Private io.Reader
    Public  io.Reader
}

func Create() (*CertificateRSA, error) {

    bitSize := 2048
    key, err := rsa.GenerateKey(rand.Reader, bitSize)
    if err != nil {
        return nil, err
    }

    var privateKey = &pem.Block{
        Type:  "RSA PRIVATE KEY",
        Bytes: x509.MarshalPKCS1PrivateKey(key),
    }

    var priBuff bytes.Buffer
    err = pem.Encode(&priBuff, privateKey)
    if err != nil {
        return nil, err
    }

    // asn1Bytes := x509.MarshalPKCS1PublicKey(&key.PublicKey)
    asn1Bytes := x509.MarshalPKCS1PublicKey(&key.PublicKey)

    var publicKey = &pem.Block{
        Type:  "PUBLIC KEY",
        Bytes: asn1Bytes,
    }

    var pubBuff bytes.Buffer

    err = pem.Encode(&pubBuff, publicKey)
    return &CertificateRSA{
        Private: &priBuff,
        Public:  &pubBuff,
    }, err
}

Can you see any problem in my code ?

And this code can generates certificates like as these:

Upvotes: 0

Answers (4)

eddien

Reputation: 71

If you get the:

Error: 7 PERMISSION_DENIED: The signature of device credential in position 0 could not be verified against any registry certificate.

error and your system used to work, check the expiration date of the root CA certificate. It will return this error if it's past the date.

Upvotes: 2

user1969176

Reputation: 99

It was a miss-match between the key format expected and the type of the key, RSA_PEM vs RSA_X509_PEM. Switching that fixed the issue.

Upvotes: 0

N.F.

Reputation: 4182

I faced the same issue. I could solve this with the following code.

package cloudIotCore

import (
    "crypto/rand"
    "crypto/rsa"
    "crypto/x509"
    "encoding/pem"
    "os"
)

func create() {

    //
    // Create key
    //
    reader := rand.Reader
    bitSize := 2048

    key, err := rsa.GenerateKey(reader, bitSize)
    if err != nil {
        panic(err)
    }

    publicKeyAsc1Bytes, err := x509.MarshalPKIXPublicKey(&(key.PublicKey))
    if err != nil {
        panic(err)
    }

    publicPemKey := &pem.Block{
        Type:  "PUBLIC KEY",
        Bytes: publicKeyAsc1Bytes,
    }

    privatePemKey := &pem.Block{
        Type:  "RSA PRIVATE KEY",
        Bytes: x509.MarshalPKCS1PrivateKey(key),
    }

    //
    // Create Device with publicPemKey
    //

    :

    //
    // Save pem files
    //

    publicPemFile, err := os.Create(PATH_TO_PUBLICKEY)
    if err != nil {
        panic(err)
    }
    defer publicPemFile.Close()

    err = pem.Encode(publicPemFile, publicPemKey)
    if err != nil {
        panic(err)
    }

    privatePemFile, err := os.Create(PATH_TO_PRIVATEKEY)
    if err != nil {
        panic(err)
    }
    defer privatePemFile.Close()

    err = pem.Encode(privatePemFile, privatePemKey)
    if err != nil {
        panic(err)
    }

}

Upvotes: 0

President James K. Polk

Reputation: 41957

The encoding header and the encoding method don't match. If you want to use

asn1Bytes := x509.MarshalPKCS1PublicKey(&key.PublicKey)

then the pem.Block Type should be Type: "RSA PUBLIC KEY",.

If you want the other common public key format, a SubjectPublicKeyInfo ASN.1 structure, then keep the pem.Block as you have it and instead use

asn1Bytes, err := x509.MarshalPKIXPublicKey(&key.PublicKey)

I don't know what GCP is expecting but it's almost certainly one or the other.

Upvotes: 0

GCP IoT core rejects this RSA_PEM public key with an error

Answers (4)

Related Questions