From c0f0b8d43c6d4b67faa9143841c9616b685f85c9 Mon Sep 17 00:00:00 2001 From: nickAS21 Date: Wed, 1 Dec 2021 17:54:37 +0200 Subject: [PATCH] lwm2m - cert trust must be signed cert with 'CN' = ...sub..{CN by server} --- .../TbLwM2MDtlsCertificateVerifier.java | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/TbLwM2MDtlsCertificateVerifier.java b/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/TbLwM2MDtlsCertificateVerifier.java index 5daf639f29..f3819edd7f 100644 --- a/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/TbLwM2MDtlsCertificateVerifier.java +++ b/common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/secure/TbLwM2MDtlsCertificateVerifier.java @@ -120,7 +120,7 @@ public class TbLwM2MDtlsCertificateVerifier implements NewAdvancedCertificateVer TbLwM2MSecurityInfo securityInfo = null; // verify if trust if (config.getTrustSslCredentials().getTrustedCertificates().length > 0) { - if (searchIssuer(cert, config.getTrustSslCredentials().getTrustedCertificates()) != null) { + if (verifyIssuer(cert, config.getTrustSslCredentials().getTrustedCertificates()) != null) { String endpoint = config.getTrustSslCredentials().getValueFromSubjectNameByKey(cert.getSubjectX500Principal().getName(), "CN"); securityInfo = StringUtils.isNotEmpty(endpoint) ? securityInfoValidator.getEndpointSecurityInfoByCredentialsId(endpoint, CLIENT) : null; } @@ -193,13 +193,16 @@ public class TbLwM2MDtlsCertificateVerifier implements NewAdvancedCertificateVer } - private static X509Certificate searchIssuer(X509Certificate certificate, X509Certificate[] certificates) { - X500Principal subject = certificate.getIssuerX500Principal(); - for (int index = 0; index < certificates.length; ++index) { - X509Certificate trust = certificates[index]; - if (trust != null && subject.equals(trust.getIssuerX500Principal())) { - if (verifyCertificate(certificate)) { - return certificate; + private X509Certificate verifyIssuer(X509Certificate certificate, X509Certificate[] certificates) { + String issuerCN = config.getTrustSslCredentials().getValueFromSubjectNameByKey(certificate.getIssuerX500Principal().getName(), "CN"); + if (!StringUtils.isBlank(issuerCN)) { + for (int index = 0; index < certificates.length; ++index) { + X509Certificate trust = certificates[index]; + String trustCN = config.getTrustSslCredentials().getValueFromSubjectNameByKey(trust.getSubjectX500Principal().getName(), "CN"); + if (!StringUtils.isBlank(trustCN) && issuerCN.length() > trustCN.length() && issuerCN.substring(issuerCN.length()-trustCN.length()).equals(trustCN)) { + if (verifyCertificate(certificate)) { + return certificate; + } } } }