--- title: "How to connect Azure IoT Central with X.509 Cert. (W55RP20)" url: "https://maker.wiznet.io/lawrence/projects/how-to-connect-azure-iot-central-with-x-509-cert-w55rp20/" markdown_url: "https://maker.wiznet.io/lawrence/projects/how-to-connect-azure-iot-central-with-x-509-cert-w55rp20/md" type: "WCC: WIZnet Created Content" author: "lawrence" author_url: "https://maker.wiznet.io/lawrence/" original_author: "lawrence" license: "MIT license (MIT)" published: "2024-10-29" language: "en" tags: ["W55RP20", "AIoT"] hardware: ["WIZnet W55RP20-EVB-Pico"] likes: 0 views: 4037 comments: 0 source: "WIZnet Makers (https://maker.wiznet.io/)" --- # How to connect Azure IoT Central with X.509 Cert. (W55RP20) > Using W55RP20-EVB-PICO board, checking how to connect to Azure IoT Central with X.509 certification. Original author: lawrence ## Components - **WIZnet W55RP20-EVB-Pico** x 1 ([docs](https://wiznet.io/products/powered-by-raspberry-pi/w55rp20-evb-pico)) - Software: **Microsoft Azure**: Azure IoT Central ([docs](https://azure.microsoft.com/en-us/)) ## Article ### Project Description This is how to connect Azure IoT Central using X.509 certification with W55RP20-EVB-PICO. Easy to describe how to make X.509 certification and how to use it for. To do this project please checking the below link and tools. > > > WSL (Ubuntu) install using OpenSSL to create X.509 certification #### Create X.509 certification with OpenSSL In WSL(Windows Subsystem for Linux), user can install Ubuntu and use OpenSSL. With this configuration, X.509 certification could be created. > MS Azure also guide how to create X.509 certification using OpenSSL. > > [\[MS Guide\] Tutorial: Using OpenSSL to create test certificates](https://docs.microsoft.com/en-us/azure/iot-hub/tutorial-x509-openssl) **1) Root CA setup and creation** Create root certification directory and related folders. ```typescript ~$ mkdir rootca ~$ cd rootca/ ~/rootca$ mkdir certs db private ~/rootca$ touch db/index ~/rootca$ openssl rand -hex 16 > db/serial ~/rootca$ echo 1001 > db/crlnumber ~/rootca$ vi rootca.conf ``` Fulfill rootca.conf file with the below fields to setup certification information. In 'req_distinguished_name', user changed own inform in contryName, stateOrProvinceName, localityName ```typescript [ req ] default_bits = 2048 default_keyfile = rootca.key distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ] countryName = KR stateOrProvinceName = Seoul localityName = Kangnam organizationName = WIZnet commonName = W55RP20-EVB-PICO [ ca ] default_ca = CA_default [ CA_default ] certs = /home/rootca/certs database = /home/rootca/db/index new_certs_dir = /home/rootca/certs certificate = /home/rootca/rootca.crt private_key = /home/rootca/private/rootca.key serial = ./db/serial default_md = sha256 policy = policy_match default_days = 3650 [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ ca_ext ] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = critical, CA:true keyUsage = critical, digitalSignature, cRLSign, keyCertSign ``` After creating rootca.conf, type the next commands to create .csr and .key ```typescript ~/rootca$ openssl req -new -config rootca.conf -out rootca.csr -keyout private/rootca.key ~/rootca$ openssl ca -selfsign -config rootca.conf -in rootca.csr -out rootca.crt -extensions ca_ext ``` When the system ask PEM pass, it must be memorized for user. It is very important password to create next cert. > Enter PEM pass phrase: Finally, rootca.cert created with this message. Type 'y' twice for the process. ![](https://maker.wiznet.io/upload/ckeditor5/50543876%5F1730224231%2Epng) **2) Sub CA setup and creation** Sub CA is for user certification secure. Directly using Root certification is very risky for the system. Sub CA is created based on Root CA but cannot be know about Root CA information. To create Sub CA, need to add [sub_ca_ext] field in rootca.conf Add the below field info into rootca.conf ```typescript [ sub_ca_ext ] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer basicConstraints = critical, CA:true, pathlen:1 keyUsage = critical, digitalSignature, cRLSign, keyCertSign ``` Sub CA creation process is the same with Root CA ```typescript ~/rootca$ cd .. ~$ ls ~$ mkdir subca ~$ cd subca/ ~/subca$ mkdir certs db private ~/subca$ touch db/index ~/subca$ openssl rand -hex 16 > db/serial ~/subca$ echo 1001 > db/crlnumber ~/subca$ vi subca.conf ``` Fulfill subca.conf file with the below fields to setup certification information. In 'req_distinguished_name', user changed own inform in contryName, stateOrProvinceName, localityName ```typescript #Please refer rootca.conf file ``` ```typescript ~/subca$ openssl rand -hex 16 > ../rootca/db/serial ~/subca$ openssl req -new -config subca.conf -out subca.csr -keyout private/subca.key ~/subca$ openssl ca -config ../rootca/rootca.conf -in subca.csr -out subca.crt -extensions sub_ca_ext ``` Finally, subca.cert created with this message. Type 'y' twice for the process. ![](https://maker.wiznet.io/upload/ckeditor5/50543876%5F1730224715%2Epng) ### Setup Azure IoT Central ![](https://maker.wiznet.io/upload/ckeditor5/50543876%5F1730223657%2Epng) ### Build and Run **1) Modify the original code** To use provisioning with X.509, select the define APP_PROV_X509 in main code > C:\RP2040\WIZnet-PICO-AZURE-C\examples\main.c ![](https://maker.wiznet.io/upload/ckeditor5/50543876%5F1730224012%2Epng) Add created certification information to the below section in sample_certs.c | variable | certificaties | | --- | --- | | pico_az_id_scope | Azure IoT Central ID scope | | pico_az_COMMON_NAME | device ID | | pico_az_CERTIFICATE | device.crt | | pico_az_PRIVATE_KEY | device.key | > C:\RP2040\WIZnet-PICO-AZURE-C\examples\sample_certs.c ![](https://maker.wiznet.io/upload/ckeditor5/50543876%5F1730224022%2Epng) **2) Build the project** ![](https://maker.wiznet.io/upload/ckeditor5/50543876%5F1730223474%2Epng) --- Source: https://maker.wiznet.io/lawrence/projects/how-to-connect-azure-iot-central-with-x-509-cert-w55rp20/