Expand description
TLS trust for the Cognitum Seed transport.
A Seed serves HTTPS with a self-signed certificate, so public-CA
verification cannot succeed. Rather than disabling verification (which
would hand the per-Seed bearer token to anyone answering the handshake),
the operator pins either the SHA-256 of the Seed’s leaf public key
(SeedTls::PinnedSpki, recommended) or of the whole leaf certificate
(SeedTls::PinnedSha256), recorded once over a trusted path (USB link
or first pairing). Any other certificate fails the handshake before a
request, and so before the Authorization header, is sent.
Firmware 0.22.20 and later cap leaf certificates at 825 days and renew them on the 6-hourly update loop, so a certificate pin can break with no operator action. The SPKI pin survives a renewal that keeps the device key; a renewal that changes the key is refused and needs the operator to re-pin over a trusted path (a new pin, never a silent re-trust).
Enums§
- SeedTls
- How an
https://Seed is authenticated.