-
Notifications
You must be signed in to change notification settings - Fork 416
Description
This issue aim to discuss about supporting Certification chains in Leshan v2.0
This was triggered by #1708.
Some facts :
- Leshan v1.x aims to support LWM2M v1.0.x
- Leshan v2.x aims to support LWM2M v1.1.x
- In LWM2M v1.1.x, "Public Key or Identity" Resource should only store the client certificate. (not the whole certificate chain. And only support DER encoding. LWM2M-v1.1.1@transport§5.2.8.3. X.509 Certificates.
- Since LWM2M v1.2.0, still limited to client certificate (not chain) but add support to PEM encoding. LWM2M-v1.2.1@transport§5.2.9.3. X.509 Certificates
- Since LWM2M v1.2.1, finally add support to certificate chain using PEM encoding. LWM2M-v1.2.1@transport§5.2.9.3. X.509 Certificates
This modificationsin LWM2M was mainly motivated by this discussion : OpenMobileAlliance/OMA_LwM2M_for_Developers#502
to prepare for this, Leshan client library can already use certificate chains in a backwards-compatible way.
Maybe we should consider to support that but I don't think backwards-compatibility is a good argument. (but maybe I didn't get you point)
FMPOV, a LWM2M client v1.1 does support PEM or certain chain. So a LWM2M server v1.2 should only send Certificate (not chain) in DER encoding.
Until now we didn't integrate LWM2M v1.2 feature in Leshan v2.x because this is out of scope.
I don't know if we should make an exception here ? If we decice we should we need to decide how ? (maybe this should not allowed by default)