Module 7: Simulating hardware security integration

Switch to the root user.

sudo su

Use the manual page to find the system-wide softhsm2.conf location. A common location is /etc/softhsm/softhsm2.conf, but the location might be different on some systems.

man softhsm2.conf

Create the directory for the softhsm2 configuration file in the system-wide location. In this example, we assume the location is /etc/softhsm/softhsm2.conf.

mkdir -p /etc/softhsm

Create the token directory in the /greengrass directory.

mkdir -p /greengrass/softhsm2/tokens

Configure the token directory.

echo "directories.tokendir = /greengrass/softhsm2/tokens" > /etc/softhsm/softhsm2.conf

Configure a file-based backend.

echo "objectstore.backend = file" >> /etc/softhsm/softhsm2.conf

Initialize the SoftHSM token.

softhsm2-util --init-token --slot 0 --label greengrass --so-pin 12345 --pin 1234

softhsm2-util --init-token --free --label greengrass --so-pin 12345 --pin 1234

Convert the private key to a format that can be used by the SoftHSM import tool. For this tutorial, you convert the private key that you obtained from the Default Group creation option in Module 2 of the Getting Started tutorial.

openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in hash.private.key -out hash.private.pem

Import the private key into SoftHSM. Run only one of the following commands, depending on your version of softhsm2-util.

This command identifies the slot as 0 and defines the key label as iotkey. You use these values in the next section.

Find the path to the SoftHSM provider library (libsofthsm2.so) on your system:

1. Get the list of installed packages for the library.

   sudo dpkg -L libsofthsm2

   The libsofthsm2.so file is located in the softhsm directory.

2. Copy the full path to the file (for example, /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so). You use this value later.

Stop the Greengrass daemon.

cd /greengrass/ggc/core/
sudo ./greengrassd stop

Open the Greengrass configuration file. This is the config.json file in the /greengrass/config directory.

In the crypto.principals object, insert the following MQTT server certificate object. Add a comma where needed to create a valid JSON file.

  "MQTTServerCertificate": {
    "privateKeyPath": "path-to-private-key"
  }

In the crypto object, insert the following PKCS11 object. Add a comma where needed to create a valid JSON file.

  "PKCS11": {
    "P11Provider": "/path-to-pkcs11-provider-so",
    "slotLabel": "crypto-token-name",
    "slotUserPin": "crypto-token-user-pin"
  }

Your file should look similar to the following:

{
  "coreThing" : {
    "caPath" : "root.ca.pem",
    "certPath" : "hash.cert.pem",
    "keyPath" : "hash.private.key",
    "thingArn" : "arn:partition:iot:region:account-id:thing/core-thing-name",
    "iotHost" : "host-prefix.iot.region.amazonaws.com",
    "ggHost" : "greengrass.iot.region.amazonaws.com",
    "keepAlive" : 600
  },
  "runtime" : {
    "cgroup" : {
      "useSystemd" : "yes"
    }
  },
  "managedRespawn" : false,
  "crypto": {
    "PKCS11": {
      "P11Provider": "/path-to-pkcs11-provider-so",
      "slotLabel": "crypto-token-name",
      "slotUserPin": "crypto-token-user-pin"
    },
    "principals" : {
      "MQTTServerCertificate": {
        "privateKeyPath": "path-to-private-key"
      },
      "IoTCertificate" : {
        "privateKeyPath" : "file:///greengrass/certs/hash.private.key",
        "certificatePath" : "file:///greengrass/certs/hash.cert.pem"
      },
      "SecretsManager" : {
        "privateKeyPath" : "file:///greengrass/certs/hash.private.key"
      }
    },    
    "caPath" : "file:///greengrass/certs/root.ca.pem"
  }
}

Edit the crypto object:

1. Configure the PKCS11 object.

   • For P11Provider, enter the full path to libsofthsm2.so.

   • For slotLabel, enter greengrass.

   • For slotUserPin, enter 1234.

2. Configure the private key paths in the principals object. Do not edit the certificatePath property.

   • For the privateKeyPath properties, enter the following RFC 7512 PKCS#11 path (which specifies the key's label). Do this for the IoTCertificate, SecretsManager, and MQTTServerCertificate principals.

     pkcs11:object=iotkey;type=private

3. Check the crypto object. It should look similar to the following:

     "crypto": {
       "PKCS11": {
         "P11Provider": "/usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so",
         "slotLabel": "greengrass",
         "slotUserPin": "1234"
       },
       "principals": {
         "MQTTServerCertificate": {
           "privateKeyPath": "pkcs11:object=iotkey;type=private"
         },
         "SecretsManager": {
           "privateKeyPath": "pkcs11:object=iotkey;type=private"
         },
         "IoTCertificate": {
           "certificatePath": "file://certs/core.crt",
           "privateKeyPath": "pkcs11:object=iotkey;type=private"
         }
       },
       "caPath": "file://certs/root.ca.pem"
     }

Remove the caPath, certPath, and keyPath values from the coreThing object. It should look similar to the following:

"coreThing" : {
  "thingArn" : "arn:partition:iot:region:account-id:thing/core-thing-name",
  "iotHost" : "host-prefix-ats.iot.region.amazonaws.com",
  "ggHost" : "greengrass-ats.iot.region.amazonaws.com",
  "keepAlive" : 600
}