DTLS Client Certificate Chain not sent

[schirrmacher]

Currently we are implementing client/server DTLS communication with Leshan for an IoT project. Unfortunately, the handshake fails because the Leshan client just sends a single certificate to the Leshan Server (recorded with Wireshark) instead of the whole chain (Root CA -> Intermediate CA -> Client Cert):

13:44:43.387 [DTLS-Retransmit-Task-1] DEBUG org.eclipse.californium.scandium.dtls.CertificateMessage - created CERTIFICATE message with certificate chain [length: 1]

The server's certificate message contains the expected chain, so there is no problem with the LeshanServerBuilder.

We definitely set the chain in the DTLS client config:

private val builder: LeshanClientBuilder = LeshanClientBuilder("1122334455667788990")
val leshanClient: LeshanClient
// ...

val dtlsConfig = DtlsConnectorConfig.Builder()
dtlsConfig.setIdentity(
            clientPrivateKey,
            arrayOf(
                clientCert,
                intermediateCAcert,
                rootCAcert
            )
)
builder.setDtlsConfig(dtlsConfig)

// ...
leshanClient = builder.build()
leshanClient.start()

In the createEndpoint(ServerInfo serverInfo) method of CaliforniumEndpointsManager I noticed the following:

newBuilder.setIdentity(serverInfo.privateKey, new Certificate[] { serverInfo.clientCertificate }); is called.
This call overwrites the chain of certificates. So a single certificate (the client certificate) is written to the DTLS config, instead of the whole certificate chain. After that createSecuredEndpoint is called with an invalid certificate chain based on the DTLS config builder, called newBuilder.

Is this a bug or should I check other parameters of my LeshanClient?

[sbernard31]

@schirrmacher, I was thinking about this, any reason why you close it ?

[sbernard31]

@schirrmacher you raised a well-known issue, I will try to get answer from OMA : OpenMobileAlliance/OMA_LwM2M_for_Developers#502

[schirrmacher]

Sorry for closing the issue, I wanted to get a deeper understanding of the problem before discussing further. Thanks for raising the issue. It seems that the specification is missing the details. Luckily the server is sending the whole chain:

[sbernard31]

Only the client certificate chain is not clear in LWM2M specification.
For server, I don't see any issue. 🙂

[dachaac]

I have changes for client to send chain (PR #896) but storage seems to be something that is not optimal.

[sbernard31]

Following OpenMobileAlliance/OMA_LwM2M_for_Developers#502 (comment), the lwm2m specification clarify that client certificate chain is limited to only 1 certificate.
At least this is my understanding. 😕

I close this issue, but it could be related in a way to #1135..