#Certificate Store

#Overview

SpringCore devices are able to store up to 16 X509 certificates.

X509 certificates are typically used for TLS communication, in two situations:

1. Validate the authenticity of the remote server (or remote peer): the SpringCore device verifies that the server’s certificate is valid and authorized using its list of approved certificate authorities,
2. Act as a proof that the SpringCore device is genuine and authorized. If this case a client certificate linked to a device-specific ECC key is used (only deviced featuring an ATECC Secure Element offer this feature).

#Certificate list

Certificates 10 to 15 (0A to 0F) are defined in factory and can’t be modified afterwards.

• Certificate 10 to 13 (0A to 0D) are the certificates for the corresponding ECC private keys, computed by SpringCard’s CAs (one for every usage).
• Certificates 14 and 15 (0E and 0F) are the certificate for two of the said CAs.
• Certificate 0 to 9 (00 to 09) are freely usable by integrators and developers. They could either store a customer-defined certificate for the device, or the certificates of the servers or PKI infrastructure the device will be client of. Use SpringCoreSE (or maybe SpringCoreConfig) to do so. For convenience, certificates 7, 8 and 9 (07, 08 and 09) are populated in factory, by they could be overwritten with no impact on the device.

#SpringCore PKI hierarchy

The subject of every certificates actually begins with C=FR,ST=Ile-de-France,L=Palaiseau,O=SpringCard. For the ease of reading, only the OU= and CN= parts are specified in the following paragraphs.

Certificates for the SpringCore devices and the related cloud-based services are structured as follow:

• The subject of the Root CA is OU=SpringCore,CN=SpringCore Root CA; the self-signed certificate is available here: SpringCard-SpringCore-Root.crt. It is stored in the devices at index 07.
• The Direct intermediate CA signs the device’s certificate used for remote Direct communication. Its subject is OU=SpringCore,CN=SpringCore Direct CA and its certificate is available here: SpringCard-SpringCore-Direct.crt.
• The Messaging intermediate CA signs the device’s certificate used for secure messaging. Its subject is OU=SpringCore,CN=SpringCore Messaging CA and its certificate is available here: SpringCard-SpringCore-Messaging.crt.
• The Server intermediate CA signs the device’s certificate used for operation as TLS server. Its subject is OU=SpringCore,CN=SpringCore Server CA and its certificate is available here: SpringCard-SpringCore-Server.crt. It is stored in the devices at index 0E.
• The Client intermediate CA signs the device’s certificate used for operation as TLS client. Its subject is OU=SpringCore,CN=SpringCore Client CA and its certificate is available here: SpringCard-SpringCore-Client.crt. It is stored in the devices at index 0F.
• The Cloud intermediate CA signs the certificates of the cloud-based services operating as TLS server. Its subject is OU=SpringCore,CN=SpringCore Cloud CA and its certificate is available here: SpringCard-SpringCore-Cloud.crt.

#Keys and certificates loaded in factory

#Device’s keys and their certificates

ECC private keys are generated in factory; they are associated to certificates 10 to 13 (0A to 0D). None of this keys and certificates can not be changed after the device has been issued.

They are intended for the following usages:

#Certificates of the CAs used by device’s certificates

Certificates 14 and 15 (0E and 0F) are initialized as follow:

They can not be changed after the device has been issued.

#Other certificates

Certificates 8 and 9 (08 and 0A) are initialized as follow:

They still can be changed even after the device has been issued.

#Customer keys and certificates

Please contact SpringCard for advanced support and/or consultancy service should you plan to use SpringCore devices with your own PKI.

SpringCard technical experts are able to help you design and validate your system’s architecture with a focus on the security scheme. Your own certificates could be inserted by SpringCard in factory to ease provisioning and deployment.

#Using the certificates for TLS operation

See use cases in the Appendixes and refer to tech.springcard.com for step-by-step examples.