[BUG] Darwin: Try to use our own certificates failed during GenerateNOCChain - no nocSigner

[robinmo]

Reproduction steps

During commissioning process we create MTRDeviceControllerStartupParams through method

- (instancetype)initWithIPK:(NSData *)ipk
         operationalKeypair:(id<MTRKeypair>)operationalKeypair
     operationalCertificate:(MTRCertificateDERBytes)operationalCertificate
    intermediateCertificate:(MTRCertificateDERBytes _Nullable)intermediateCertificate
            rootCertificate:(MTRCertificateDERBytes)rootCertificate;

failed with the log

] <Notice>: Commissioning stage next step: 'ValidateCSR' -> 'GenerateNOCChain'
Apr 21 14:56:45 iPhone Deco(Matter)[12196] <Notice>: Performing next commissioning step 'GenerateNOCChain'
Apr 21 14:56:45 iPhone Deco(Matter)[12196] <Notice>: Getting certificate chain for the device from the issuer
Apr 21 14:56:45 iPhone Deco(Matter)[12196] <Error>: Unable to process Op CSR
Apr 21 14:56:45 iPhone Deco(Matter)[12196] <Error>: Failed to process the certificate signing request
Apr 21 14:56:45 iPhone Deco(Matter)[12196] <Notice>: Error on commissioning step 'GenerateNOCChain': '/Library/Caches/com.apple.xbs/Sources/CHIPFramework/connectedhomeip/src/darwin/Framework/CHIP/MTROperationalCredentialsDelegate.mm:89: CHIP Error 0x00000003: Incorrect state'
Apr 21 14:56:45 iPhone Deco(Matter)[12196] <Error>: Failed to perform commissioning step 11
Apr 21 14:56:45 iPhone Deco(Matter)[12196] <Notice>: Going from commissioning step 'GenerateNOCChain' with lastErr = '/Library/Caches/com.apple.xbs/Sources/CHIPFramework/connectedhomeip/src/darwin/Framework/CHIP/MTROperationalCredentialsDelegate.mm:89: CHIP Error 0x00000003: Incorrect state' -> 'Cleanup'
Apr 21 14:56:45 iPhone Deco(Matter)[12196] <Notice>: Performing next commissioning step 'Cleanup' with completion status = '/Library/Caches/com.apple.xbs/Sources/CHIPFramework/connectedhomeip/src/darwin/Framework/CHIP/MTROperationalCredentialsDelegate.mm:89: CHIP Error 0x00000003: Incorrect state'
Apr 21 14:56:45 iPhone Deco(Matter)[12196] <Notice>: Expiring failsafe on proxy 0x10f929e00

Read the source code and found:
in the init function implementation, forget to set the value for _nocSigner

we try to fix this by add the follow code and it works

- (instancetype)initWithIPK:(NSData *)ipk
         operationalKeypair:(id<MTRKeypair>)operationalKeypair
     operationalCertificate:(MTRCertificateDERBytes)operationalCertificate
    intermediateCertificate:(MTRCertificateDERBytes _Nullable)intermediateCertificate
            rootCertificate:(MTRCertificateDERBytes)rootCertificate
{
    ```
...
    _ipk = [ipk copy];
// we add this line
    _nocSigner = operationalKeypair;
    NSLog(@"Matter step====_nocSigner = operationalKeypair;");
...
}

Could you please help to fix this issue?

Bug prevalence

Whenever I do this

GitHub hash of the SDK that was being used

9c0ca13 - Fix Linux standalone job. (#23897)

Platform

darwin

Platform Version(s)

iOS 16.2

Anything else?

No response

[bzbarsky-apple]

During commissioning process we create MTRDeviceControllerStartupParams through method

@robinmo You're using the init method meant to be used for the "This controller will not have a way to sign its own certificates" case, which is why it requires you to provide the controller's certificates.

If you then use this controller to commission things, it will not be able to sign a NOC for the commissionee itself, since it has no way to sign certificates. I will adjust the documentation to make this clearer.

You have two options here:

1. If you do want the controller to issue its own certificates, you should be initializing it via

   - (instancetype)initWithIPK:(NSData *)ipk
                  fabricID:(NSNumber *)fabricID
                 nocSigner:(id<MTRKeypair>)nocSigner;
   

   You can then still provide explicit certificates if you want to, by just setting the relevant fields of the startup params.
2. If you do not want the controller to issue its own certificates, and want to use your own external CA instead, but you want the controller to commission things, you should init the startup params as you do now, but then set the operationalCertificateIssuer and operationalCertificateIssuerQueue on the startup params, and use that to issue certificates as needed.

[bzbarsky-apple]

@robinmo #26251 to improve the documentation.

[robinmo]

#26251

👍Many thanks, @bzbarsky-apple
I will try that tomorrow.

By the way, as the old day you mentation here

we try to use CHIP matter framework below 15.4, and change some code, it can commission sucess. I am a litter curious about what is the demand of this limitation of 15.4 ?

[bzbarsky-apple]

@robinmo I don't know how to answer that question without knowing exactly what "change some code" entailed.

[robinmo]

@robinmo I don't know how to answer that question without knowing exactly what "change some code" entailed.

Wait a moment. I am clone this repo on my personal mac. If done, I will show the code changed.

[robinmo]

@bzbarsky-apple
Tired of the internet speed😪, maybe tomorrow to show the code.

[robinmo]

@bzbarsky-apple
Check.
explicit link with CoreNFC.framework and set status to optional

[bzbarsky-apple]

OK, but how are you starting your controllers there, etc?

[robinmo]

OK, but how are you starting your controllers there, etc?

@bzbarsky-apple same as the sample code

[bzbarsky-apple]

So you are saying that:

1. You are using

   - (instancetype)initWithIPK:(NSData *)ipk
            operationalKeypair:(id<MTRKeypair>)operationalKeypair
        operationalCertificate:(MTRCertificateDERBytes)operationalCertificate
       intermediateCertificate:(MTRCertificateDERBytes _Nullable)intermediateCertificate
               rootCertificate:(MTRCertificateDERBytes)rootCertificate;
   

   when creating the controller startup params.
2. You are then able to commission things using that controller when running on things before 15.4?

If that's not what you are saying, then what exactly are you saying?

[robinmo]

@bzbarsky-apple
yeb, that's it.