You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
Enrollee configuration currently only supports bootstrapping type qrcode. Internally, this requires/forces the use of the TPM openssl engine which means systems without a TPM cannot be used for testing.
Describe the solution you'd like
An option should be configurable for enrollees to specify a static DPP bootstrapping key for use with bootstrapping type qrcode. For example, the json configuration could look something like this:
There could even be an auto-generation method where ztpd auto-generates a bootstrapping key and outputs it somewhere that is easy to be found (eg. journald logs or a file). Eg.
wpa_supplicant already supports this when creating a new bootstrapping key without also providing private key (it get's auto-generated on first use). The public key can be obtained later using the bootstrapping id and the DPP_BOOTSTRAP_GET_URI <ID> control socket command.
Describe alternatives you've considered
Alternatives are currently to program wpa_supplicant manually using cli tools (eg. wpa_cli). This is clunky and disrupts instrumentation between ztpd and wpa_supplicant, and is annoying for our partners to use since they then have to mess with systemd unit configuration resets and custom configuration.
Additional context
Our partner engineering teams need a better method to test their configurator against our enrollee without too much effort/ramp-up/setup. A similar method exists for the configurator, the file based BIP, which allows specification of static DPP URIs for supported enrollees. The request here is to provide an analogous option for enrollee testing.
The text was updated successfully, but these errors were encountered:
abeltrano
changed the title
Add option to specify static DPP URI for role=enrollee
Add option to specify static DPP bootstrap key for role=enrollee
Jul 2, 2021
Is your feature request related to a problem? Please describe.
Enrollee configuration currently only supports bootstrapping type
qrcode
. Internally, this requires/forces the use of the TPM openssl engine which means systems without a TPM cannot be used for testing.Describe the solution you'd like
An option should be configurable for enrollees to specify a static DPP bootstrapping key for use with bootstrapping type
qrcode
. For example, the json configuration could look something like this:There could even be an auto-generation method where ztpd auto-generates a bootstrapping key and outputs it somewhere that is easy to be found (eg. journald logs or a file). Eg.
wpa_supplicant already supports this when creating a new bootstrapping key without also providing private key (it get's auto-generated on first use). The public key can be obtained later using the bootstrapping id and the
DPP_BOOTSTRAP_GET_URI <ID>
control socket command.Describe alternatives you've considered
Alternatives are currently to program wpa_supplicant manually using cli tools (eg.
wpa_cli
). This is clunky and disrupts instrumentation between ztpd and wpa_supplicant, and is annoying for our partners to use since they then have to mess with systemd unit configuration resets and custom configuration.Additional context
Our partner engineering teams need a better method to test their configurator against our enrollee without too much effort/ramp-up/setup. A similar method exists for the configurator, the
file
based BIP, which allows specification of static DPP URIs for supported enrollees. The request here is to provide an analogous option for enrollee testing.The text was updated successfully, but these errors were encountered: