nerves-hub / documentation Goto Github PK

In the past week or so I went through adding NervesHubLink and NervesKey to one of my projects and came away with some lessons I want to contribute to the documentation.

My feedback is that it is quite hard to wrap one's head around all the key/cert pairs and what role each one plays and which ones are needed based on whether NervesKey is used or not.

Since the docs are open source I will go ahead and work on improving the docs so that it's easier to comprehend the setup and the key/cert usage options.

At first, thanks for your great works. I'm really interested in Nerves.

Now I'm confusing about terms of Nerves Key document.

My confusing part is below, quotes from https://github.com/nerves-hub/documentation/blob/5b1ed2dc48b5ffb75f7cd6bae17ab0018b580ebf/nerves-key/private-key-storage.md

The NervesKey holds information for up to four certificates:

1. A primary device certificate
2. The certificate that signed the primary device certificate
3. An auxiliary device certificate
4. The certificate that signed the auxiliary device certificate

The provisioning procedure requires a signing certificate and creates the primary device certificate. Both certificates are recorded to the NervesKey. The auxiliary certificates are similar in function, but can be filled in later and rewritten.

The X.509 certificate that signs the device certificate is also called a Device Certificate Authority certificate (Device CA certificate) and must be uploaded to NervesHub for the device to be allowed to connect over TLS.

for simplicity, I just talk about 1 (a primary device certificate) and 2.

1 is signed by 2.
(So I think 1 is public key and 2 is private key, right?

2 is also called a signing certificate.
2 is also called a Device CA certificate in above sentence.

Next, confusing part is below, quotes from https://github.com/nerves-hub/documentation/blob/5b1ed2dc48b5ffb75f7cd6bae17ab0018b580ebf/nerves-key/provisioning-in-elixir.md

To provision a NervesKey, make sure that you have the following:

1. A Device CA certificate and its private certificate (this is also referred to as a signing certificate)

2. A serial number for your device

3. A name for the device

In this sentence "A Device CA certificate" seems public key.

I feel there is inconsistency.