Greengrass v2 periodic certificate rotation


Dear community,

I'm running Greengrass v2 as a docker container using the plugin fleet provision by claim (CSR) to take care of the provisioning. I'd like to periodically rotate the certificates (e.g. every month). On the GGv1 one could set an expiration date on the certificates but that seems to be not possible on GGv2 (looking at the API docs). Also, I've checked the plugin fleet provisioning by claim source code and such feature is not implemented.

Any suggestions?

many thanks in advance, Daniel

asked 2 years ago277 views
1 Answer
Accepted Answer

Hi Daniel,

Core device cert rotation is not supported by Greengrass (v1 or v2), you'll need to implement your own rotation mechanism. Here's an example solution that may be relevant.

The GGv1 cert rotation I believe you're referring to is for the MQTT server cert, which has a configurable expiration.

In GGv2, the analogous way to rotate the MQTT server cert is via the Client Device Auth component's serverCertificateValiditySeconds configuration, which defaults to 7 days.

answered 2 years ago
  • Hi Joseph, thanks for your answer.

    I meant the core device cert rotation only (mentioned the MQTT server cert by mistake, sorry for that).

    If I implement something like the example solution, then after the cert rotation the container would have to be restarted, is that correct? Could I use IPC (e.g. CertificateUpdateEvent) to "notify" greengrass (v2) that the certificate has been rotated?

  • Yep after rotation, greengrass will need to be restarted so the connection to IoT Core uses the new cert. There's no built-in way to notify greengrass when a core device's IoT cert rotates, unfortunately. CertificateUpdateEvent/SubscribeToCertificateUpdates applies to the MQTT server cert, not the device's IoT cert.

  • Ok, thanks a lot.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions