Azure-iot-sdk-csharp: [Technical Question] Retrieve module certificates from Workload API

[langebo]

We are currently developing a custom module that interacts with the Event Grid on IoT Edge and Azure Blob Storage on IoT Edge modules. Further it exposes a gRPC endpoint for other custom modules and a Webhook API controller for events coming from the Event Grid subscriptions. Our custom module is based on an ASP.NET Core 3.1 Kestrel implementation.

For development purposes, we are currently disabling all certificate based authentication when calling the Event Grid and Blob Storage modules. The exposed gRPC and Controller endpoints are currently served over HTTP (non TLS/SSL). We are now at the point of evaluating production readiness of this module an are therefor in need to retrieve the required certificates for server and client authentication.

The article about the Workload API suggests, that these certificates can be retrieved from the Workload API. But using the Device/Module SDK we are unable to find a way to do so.

What we would like to do is on the one hand use a certificate for our custom server module (ASP.NET Core) so that our exposed endpoints are being secured. That especially important so the Event Grid module can be configured to validate the Webhooks certificate. On the other hand we need the certificate chain, so that the HttpClientHandler can validate the server certificate of the aforementioned Azure IoT modules. What is the correct way of retrieving those certificate information?

We went through the dev/test certificate tutorial here but that only describes the process needed to authenticate communication between IoT Hub and Devices. What we are looking for is the certificate authentication workflow for module-to-module communication.

[bikamani]

@langebo Thanks for your question. We will look into this soon, is this a blocker for you?

[damonbarry]

@langebo Your custom module won't use the IoT SDK to get a server cert. The IoT SDK only uses the workload API in very limited client scenarios. If you want your custom module to act as a server, you'll want to call the workload API directly (it's REST over UDS) to create the server cert. This is exactly what the Event Grid module is doing.

Actually, the Event Grid module docs and code are a good place to get information about how this works. Specifically, check out the Event Grid module's security documentation. Also look at their implementation to see how they get the server cert from the workload API.

[langebo]

@bikamani No, it's not a blocker.

@damonbarry Thank you for pointing in that direction. We have already looked into that solution and took guidance for our implementation. I am glad, that we found the right example. I was already worried, that we didn't find the "obvious" way of establishing certificate-based server-/client authentication.

Is there a plan of you adopting this client into the IoT SDK?

Closing this since I think we are on track now.

[az-iot-builder-01]

@damonbarry, @langebo, thank you for your contribution to our open-sourced project! Please help us improve by filling out this 2-minute customer satisfaction survey