By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Greengrass v2 periodic certificate rotation

0

Dear community,

I'm running Greengrass v2 as a docker container using the plugin fleet provision by claim (CSR) to take care of the provisioning. I'd like to periodically rotate the certificates (e.g. every month). On the GGv1 one could set an expiration date on the certificates but that seems to be not possible on GGv2 (looking at the API docs). Also, I've checked the plugin fleet provisioning by claim source code and such feature is not implemented.

Any suggestions?

many thanks in advance, Daniel

Topics
Internet of Things (IoT)
Tags
AWS IoT GreengrassAWS IoT Core
Language
English
dsantos
asked 2 years ago237 views
1 Answer
2
Accepted Answer

Hi Daniel,

Core device cert rotation is not supported by Greengrass (v1 or v2), you'll need to implement your own rotation mechanism. Here's an example solution that may be relevant.

The GGv1 cert rotation I believe you're referring to is for the MQTT server cert, which has a configurable expiration.

In GGv2, the analogous way to rotate the MQTT server cert is via the Client Device Auth component's serverCertificateValiditySeconds configuration, which defaults to 7 days.

AWS
Joseph Cosentino
answered 2 years ago
  • dsantos
    2 years ago

    Hi Joseph, thanks for your answer.

    I meant the core device cert rotation only (mentioned the MQTT server cert by mistake, sorry for that).

    If I implement something like the example solution, then after the cert rotation the container would have to be restarted, is that correct? Could I use IPC (e.g. CertificateUpdateEvent) to "notify" greengrass (v2) that the certificate has been rotated?

  • Joseph Cosentino
    2 years ago

    Yep after rotation, greengrass will need to be restarted so the connection to IoT Core uses the new cert. There's no built-in way to notify greengrass when a core device's IoT cert rotates, unfortunately. CertificateUpdateEvent/SubscribeToCertificateUpdates applies to the MQTT server cert, not the device's IoT cert.

  • dsantos
    2 years ago

    Ok, thanks a lot.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content