如何从根证书生成公共证书，私钥？

Question

I have the root certificate pem file from a Linux server. The application that needs to connect to that server is telling me it needs a publicCert pem file and a privateKey pem file to communicate with the server.

Do I generate these from the root certificate? My thought is that I would feed openssl the path to the root cert and then it would dump out the publicCert/privateKey I want.

I've created the certs on the server as described here . Now I need to install on the downstream device as described here .

The input of client connection I need to use requires these parameters:

connString: 'HostName=foo'
protocol: MQTT
publicKeyCertificateString: certificateString or path to certificate
privateKeyString: keyString or path to key

new DeviceClient(connString, protocol, publicKeyCertificateString, privateKeyString);

• Cert format: pem
• Authentication Format: x509

Answer 1

You would only need the Root CA certificate to be available in the trust store of the downstream device. What you seem to be looking to do is mutual authentication. Azure IoT Edge doesn't currently support downstream devices to connect using client certificates (mutual authentication). (Edge device only supports symmetric key authentication but doesn't support x509 certificate authentication). For publishing messages using MQTT, you would need to generate a SAS token for the downstream device and then use it to communicate with iot hub (edge device would act as a transparent gateway).

Related : c# Azure IOT Edge Auto-provision with Device Provisioning Service(DPS) with x509 certificate sample needed