X.509 Client Authentication in Zephyr
summary
Shows a working end-to-end X.509 client-auth flow for Zephyr using MbedTLS and TF-M, with concrete commands (OpenSSL) to generate CA/server/device certs, a Go TLS server configured for mutual TLS, and Zephyr code that loads credentials via tag lists and socket options (TLS1.2 + verify). Describes storage-free key derivation from an HUK, a Linaro-backed Linaro CA + bootstrap management, warns against storing private keys, and demonstrates a reproducible proof-of-concept that actually runs.
AI-written summary · about
chapters (8)
- 0:00Introduction and overview
- 1:02Understanding mutual TLS
- 5:54Benefits of X.509 auth
- 11:10Generating certificates
- 21:02Setting up the server
- 25:46Implementation in Zephyr
- 29:18Best practices and conclusions
- 32:00Q&A session
related talks
07mIntegration of a CA Certificate Store Into Zephyr RTOS
30mProvisioning in Zephyr
30mHashiTLS: Demystifying Security Certs
38mIoT TLS: Why It's Hard
27mZephyr and Trusted Execution Environments
41mWiFi and Secure Socket Offload in Zephyr
24mHardware backed attestation in TLS
42mCryptography Support in Zephyr: Recent Changes and Upcomings