Package apple.matter.protocol

Interface MTROperationalCertificateIssuer

  • public interface MTROperationalCertificateIssuer
    API-Since: 16.4

    • Method Detail

      • issueOperationalCertificateForRequestAttestationInfoControllerCompletion

        void issueOperationalCertificateForRequestAttestationInfoControllerCompletion​(@NotNull
                                                                              @NotNull MTROperationalCSRInfo csrInfo,
                                                                              @NotNull
                                                                              @NotNull MTRDeviceAttestationInfo attestationInfo,
                                                                              @NotNull
                                                                              @NotNull MTRDeviceController controller,
                                                                              @NotNull
                                                                              @NotNull MTROperationalCertificateIssuer.Block_issueOperationalCertificateForRequestAttestationInfoControllerCompletion completion)
        When an MTROperationalCertificateIssuer is set for an MTRDeviceController, it will be used to issue operational certificates as needed during commissioning. Commissioning will pause when issueOperationalCertificateForRequest:attestationInfo:completion: is called, and resume when the completion is invoked with a non-nil MTROperationalCertificateChain. When the completion is invoked with an error, commissioning will fail. This will be called on the dispatch queue passed as operationalCertificateIssuerQueue in the MTRDeviceControllerFactoryParams. The csrNonce in the provided MTROperationalCSRInfo will be the nonce that was sent in the CSRRequest command, which will be guaranteed, at this point, to match the nonce in the CSRResponse command.

      • shouldSkipAttestationCertificateValidation

        boolean shouldSkipAttestationCertificateValidation()
        A way for MTROperationalCertificateIssuer to control whether it wants the Matter framework to perform device attestation checks that require trust anchors. If this returns NO, then productAttestationAuthorityCertificates should be passed in via MTRDeviceControllerFactoryParams, as well as any desired additional certificationDeclarationCertificates. If this returns YES, then all device attestation checks that require some sort of trust anchors are delegated to this MTROperationalCertificateIssuer, which can use the arguments passed to issueOperationalCertificateForRequest:attestationInfo:controller:completion: to perform the checks. Specifically, the following device attestation checks are not performed and must be done by the MTROperationalCertificateIssuer: (1) Make sure the PAA is valid and approved by CSA. (2) VID-scoped PAA check: if the PAA is VID scoped, then its VID must match the DAC VID. (3) cert chain check: verify PAI is signed by PAA, and DAC is signed by PAI. (4) PAA subject key id extraction: the PAA subject key must match the PAA key referenced in the PAI. (5) CD signature check: make sure a valid CSA CD key is used to sign the CD. This will be read on an arbitrary queue and must not block or call any Matter APIs.