[question] how to get certificate chain

[infineon]

[question] how to get certificate chain

[ayushev]

Hi Vedat,

the samples you have are pre-provisioned by Infineon with the default PKI setup (the file to which you are referring). After order more than a Minimum Order Quantity it is possible to define your own configuration of the PKI. In case of the order less than this amount, there are still options to personalize the samples either via this application note, or via distributors.
That was sort of an intro. Answering your question, the end device certificate (bottom level in the picture) is the only certificate you can find by default on OPTIGA(TM) Trust X (except for Trust Anchors). The other two certificates are common among all default samples (including your sample).
These certificates can be found here:

• Intermediate Level:
  • PEM encoded
  • DER encoded
• Top Level:
  • DER encoded

The example code to read out the end device certificate can be found as you mentioned either in Nordic SDK or in the example_optiga_util_read_data.c

[ozanoner]

Thanks for the answer, Artem! So where is the corresponding private key of that default certificate? Stored in eFIRST_DEVICE_PRIKEY_1?

[ayushev]

You are welcome!
Yes, the Object ID of this slot (one of four) is 0xE0F0, which is defined in the code as eFIRST_DEVICE_PRIKEY_1

[ozanoner]

Is there anyway to extract it? I tried to read it (optiga_util_read_data), but gives error of 'Access conditions not satisfied 0x07'.

The value of its metadata (optiga_util_read_metadata):

20 06 E0 01 03 E1 01 01

E0 -> Algorithm associated with key container (value: Elliptic Curve Key on NIST P256 curve)
E1 -> Key usage associated with key container (value: Auth)
I don't see anything regarding to 'read' policy.

[ayushev]

A short answer is neither you nor anybody else can read out the private key, due to security reasons.
The private key can't be imported as well, only as a part of the keypair generation routine you can create the private part.

You can't read the private key because the access conditions are not satisfied (the access conditions for this objects is Execute/EXE, which means it can only be used internally by the Trust X; e.g. by the signature generation routine)
More about access conditions you can find here

[ozanoner]

It is clear now. I thought it needs to be queried, by looking at examples in the solution reference manual. Sorry for taking your time.

[ayushev]

You ask reasonable questions which hopefully can help others answer their.