How to create a certificate based on the Mixed certificate chain in OnBoard™ IoT Security

This article will guide you on how to create a certificate for a mixed certificate chain in OnBoard™ IoT Security (OBIS).

Prerequisites

Before getting started, please ensure that you have OBIS role permissions as a System Manager or SE Resource Manager.

操作步骤

tip

After a mixed certificate chain is created, when configuring the SE Profile in SEMS, you can select the corresponding CA-KLCC (Controlling Authority for Confidential Key Loading Card Certificates), CA-KLOC (Controlling Authority for Confidential Key Loading OCE Certificates), KA-KLCC (Intermediate Key Authority for Confidential Key Loading Card Certificates), KA-KLOC (Intermediate Key Authority for Confidential Key Loading OCE Certificates), SD certificate, or OCE (Off-Card Entity) certificate in the SCP11c configuration.

1. Sign in to OBIS。

2. In the Core section of the left menu, click GPCA, and then click Create on the GP CA Objects page.

   

Create a Root CA (CA-KLCC / CA-KLOC)

tip

• CA-KLCC is the root CA for the SD certificate chain and is used to issue and manage subordinate KA-KLCC and SD certificates.
• CA-KLOC is the root CA for the OCE certificate chain and is used to issue and manage subordinate KA-KLOC and OCE certificates.

1. On the Add Root CA panel, select Generate by System or Bring Your Own Root Certificate as needed.

   

   Description of Root CA basic information:

   Information	Generate by System	Bring Your Own Root Certificate
   Certificate Data (7F21 Hex)	N/A	Enter the Hex certificate data in the GlobalPlatform certificate format (must start with 7F21). Note: The Issuer Identifier and Subject Identifier of the certificate must match.
   Name	The Root CA name must be unique in the same environment.
   Chain	Select the Mixed Chain.
   Environment	Two environments can be selected: Production or Test.
   Expiration Setting	You can choose Duration, Specific Date, or Never Expires to set the validity period as needed.	N/A
   Certificate Identifier (Tag 5F20)	Hex-encoded data for the certificate identifier. The system generates a 16-byte random value by default, which can be manually modified.
   Description	Provide additional information related to the Root CA, such as special requirements and important notes.

2. After verifying that the information is correct, click Create to complete the Root CA creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

Create an Intermediate KA (KA-KLCC or KA-KLOC)

info

Before creating an Intermediate KA, please ensure that at least one Root CA has been created so that it can be selected and inherited during configuration.

1. On the GP CA Objects page, expand the corresponding certificate chain, click the Options icon for the corresponding Root CA and select Add Intermediate KA.

   

2. On the Add Intermediate KA panel, select and enter the basic information.

   • If the issuer of the intermediate KA is your own Root CA, you can select Generate key pair (offline signing) or Import signed certificate (your own intermediate KA) as needed

     

     Information	Generate key pair (offline signing)	Import signed certificate
     Certificate Data (7F21 Hex)	N/A	Enter the Hex certificate data in the GlobalPlatform certificate format (must start with 7F21). Note: The Issuer Identifier and Subject Identifier of the certificate must match.
     Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
     Type	Two types can be selected: KA-KLCC or KA-KLOC.
     Environment	The environment is inherited from the Root CA.
     Issuer	The inherited Root CA.
     Description	Provide additional information related to the Intermediate KA, such as special requirements and important notes.

   • If the issuer of the intermediate KA is the system-generated Root CA

     

     Information	Description
     Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
     Type	Two types can be selected: KA-KLCC or KA-KLOC.
     Environment	The environment is inherited from the Root CA.
     Issuer	The inherited Root CA.
     Expiration Setting	You can choose Duration, Specific Date, or Never Expires to set the validity period as needed.
     Description	Provide additional information related to the Intermediate KA, such as special requirements and important notes.

3. After verifying that the information is correct, click Create to complete the Intermediate KA creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

   When creating an Intermediate KA, if the issuer is your own Root CA, you must complete the external issuance steps for the Intermediate KA. Before the external issuance is completed, the certificate will remain in the Pending status and can't be used.

External issuance steps for the Intermediate KA

tip

When creating an Intermediate KA, if the issuer is your own root CA, refer to the following steps to complete the external issuance.

1. On the GP CA Objects page, expand the corresponding certificate chain, and then click the corresponding Intermediate KA.

2. Locate the Copy public key section on the certificate page, click Copy. Then, use your external CA to sign this public key, thereby generating an intermediate CA certificate issued by the external CA.

   

3. After issuance is complete, enter the certificate data (7F21 Hex) issued by the external CA in the Upload Signed Certificate section.

4. Click Submit. Once the configuration is completed, the Intermediate KA status will change to Active.

Create an SD or OCE certificate

info

Before creating an SD or OCE certificate, please ensure that at least one Root CA or Intermediate KA has been created so that it can be selected and inherited during configuration.

1. On the GP CA Objects page, expand the corresponding certificate chain, click the Options icon for the corresponding root or Intermediate KA and select Add SD Certificate or Add OCE Certificate.

   

2. On the Add SD Certificate (Mode B) or Add OCE Certificate page, select and enter the basic information.

   

   Description of SD or OCE certificate basic information:

   Information	Description
   Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
   Type	Default is SD Certificate or OCE Certificate.
   Environment	The environment is inherited from the Root CA or Intermediate KA.
   Issuer	The inherited Root CA or Intermediate KA.
   Expiration Setting	You can choose Duration, Specific Date, or Never Expires to set the validity period as needed. Note: If the issuer is your own Root CA or Intermediate KA, the validity period will be inherited from the Root CA or Intermediate KA.
   Description	Provide additional information related to the OCE certificate, such as special requirements and important notes.

3. After verifying that the information is correct, click Issue complete the SD or OCE certificate creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

   When creating an SD or OCE certificate, if the issuer is your own Root CA or Intermediate KA, you must complete the external issuance steps for the SD or OCE certificate. Before the external issuance is completed, the template will remain in the Pending status and can't be used.

External issuance steps for the SD or OCE certificate

tip

When creating an SD or OCE certificate, if the issuer is your own Root CA or Intermediate KA, refer to the following steps to complete the external issuance.

1. On the GP CA Objects page, expand the corresponding certificate chain, and then click the corresponding SD or OCE certificate.

2. Locate the Copy public key section on the certificate page, click Copy. Then, use your Root CA or Intermediate KA to sign the file, thereby generating an SD or OCE certificate signed by the Root CA or Intermediate KA.

   

3. After issuance is complete, enter the certificate data (7F21 Hex) issued by the external Root CA or Intermediate KA in the Upload Signed Certificate section.

4. Click Submit. Once the configuration is completed, the SD or OCE certificate status will change to Active.