How to use device certificate instead of CA certificate during GET_CERTIFICATE

[Mumunn]

Hi,
I'm using spdm-emu(version 3.4.0) to simulate SPDM on ubuntu 22.04, and I've noticed that the requester is verifying signatures using CA certificates during GET_CERTIFICATE command. Could you please tell me how I can configure the requester to verify signatures using device certificates instead? I'm following the following process to set up my simulation environment:
git submodule update --init --recursive mkdir build cd build cmake -DARCH=x64 -DTOOLCHAIN=GCC -DTARGET=Debug -DCRYPTO=mbedtls .. make copy_sample_key make
And I used the following process to run simulation:
./spdm_responder_emu
./spdm_requester_emu --ver 1.0 >spdm_req.log

[steven-bellock]

@Wenxing-hou can you help here?

[Wenxing-hou]

Sure. The spdm-emu requester will call libspdm_read_responder_root_public_certificate to set the responder CA cert to the requester.

        res = libspdm_read_responder_root_public_certificate(m_use_hash_algo,
                                                             m_use_asym_algo,
                                                             &data, &data_size,
                                                             &hash, &hash_size);
        if (res) {
            libspdm_x509_get_cert_from_cert_chain(
                (uint8_t *)data + sizeof(spdm_cert_chain_t) + hash_size,
                data_size - sizeof(spdm_cert_chain_t) - hash_size, 0,
                &root_cert, &root_cert_size);
            libspdm_zero_mem(&parameter, sizeof(parameter));
            parameter.location = LIBSPDM_DATA_LOCATION_LOCAL;
            libspdm_set_data(spdm_context,
                             LIBSPDM_DATA_PEER_PUBLIC_ROOT_CERT,
                             &parameter, (void *)root_cert, root_cert_size);

If you want use the device certificate rather than CA cert, there are one way what I can think of.

1. You need find the CA cert in the folder: spdm-emu\libspdm\unit_test\sample_key.

    switch (base_asym_algo) {
    case SPDM_ALGORITHMS_BASE_ASYM_ALGO_TPM_ALG_RSASSA_2048:
    case SPDM_ALGORITHMS_BASE_ASYM_ALGO_TPM_ALG_RSAPSS_2048:
        file = "rsa2048/ca.cert.der";
        break;

2. Then replace the cert with your device cert in the folder(The name should be same. And please ensure the device cert can verify the responder cert-chain successfully).
3. Then use the command: make copy_sample_key
4. Run the spdm-emu

[Mumunn]

Ok, thank you!