A major customer gets its device certificates from its IT department. However, their IT department do not usually give out certificates which lasts more than 3 years, as per policy. With IoT devices this becomes a challenge because IoT devices can last for decades and they don’t seem to have a way to rotate device certificates (which are stored in hardware - HSM).

While this is bad security practice they are asking for an option to allow Mender Gateway (our new mTLS Ambassador) to validate device certificates successfully even though they are expired.

Acceptance criteria

• There is a configuration option in Mender Gateway to allow expired device certificates

• If this option is enabled, expired device certificates are considered valid, as long as no other certificates are expired (including the CA that signed the device certificate)

• All other certificate verification is still carried out if this is enabled

• This can be enabled for specific tenants in Hosted Mender and specific tenants on-premise Mender Enterprise

Implementation details

• Lower the tls.Config.ClientAuth level to tls.RequireAnyClientCert

  • NOTE: This will skip any actual client certificate verification checks

• Implement the tls.Config.VerifyPeerCertificate to perform the certificate verification checks (see here for the crypto/tls implementation)

  • The raw certificates need to be parsed again (see here).

  • Use the parsed client certificate (first in the chain) NotAfter claim to override the x509.VerifyOptions.CurrentTime

  • NOTE: The verifiedChains argument will be nil because of missing verification