Install and run TrustEdge with Zephyr RTOS

Run the following command to install the required tools:

sudo apt install zip unzip

Run the following command to load certificates into flash:

./scripts/ci/trustedge/ci_trustedge_build_zephyr.sh --board native_sim

./src/examples/zephyr_examples/device_provision/provision_flash.sh --load-certs --bootstrap <path/to/boostrap/zip>
./bin/trustedge

The above command loads both the Root CA certificate and the server’s private key and certificate into the device’s flash storage. The Root CA certificate is necessary for the EST protocol when connecting to the DigiCert® Device Trust Manager, while the server key and certificate pair are needed to authenticate and secure the TLS communications with the TrustEdge REST API server.

Run the following command to build and run TrustEdge:

./scripts/ci/trustedge/ci_trustedge_build_zephyr.sh --board native_sim

./src/examples/zephyr_examples/device_provision/provision_flash.sh --load-certs --bootstrap <path/to/boostrap/zip>
./bin/trustedge

Run a curl request to verify the TrustEdge build:

curl --cacert ${MOCN_MSS}/pki_certs/rootCA.pem https://localhost:8443/v1/key/asymmetric -H 'Content-Type: application/json' -d '{
    "keyCertAttributes": {
        "outputMode": "buffered",
        "algorithm": "rsa+2048",
        "keySource": "SW"
    }
}'

Run the curl request once again to trigger an enrollment flow:

 curl --cacert ${MOCN_MSS/co}/pki_certs/rootCA.pem https://localhost:8443/v1/certificate/enroll -H 'Content-Type: application/json' -d@${MOCN_MSS}/src/trustedge/test/data/est_request.json

Inspect Flash (LittleFS) on host machine using a provisioning tool called FUSE:

$ ./src/examples/zephyr_examples/device_provision/build/zephyr/zephyr.exe
Mounting flash at flash/
uart connected to pseudotty: /dev/pts/2
[00:00:00.000,000] <inf> littlefs: littlefs partition at /lfs1
*** Booting Zephyr OS build v4.0.0-3113-g5aeda6fe7dfa ***
[00:00:00.000,000] <inf> littlefs: LittleFS version 2.9, disk version 2.1
[00:00:00.000,000] <inf> littlefs: FS at flash-controller@0:0x100000 is 768 0x1000-byte blocks with 512 cycle
[00:00:00.000,000] <inf> littlefs: partition sizes: rd 16 ; pr 16 ; ca 64 ; la 32
[00:00:00.000,000] <inf> app: Total partition size: 12288 bytes
[00:00:00.000,000] <inf> app: Available size: 11376 bytes

Run the following command in another terminal to view the lfs1 directory structure, including config, certs, and logs.

$ cd ${MOCN_MSS}
$ tree flash/
flash
└── lfs1
    ├── bootstrap.zip
    ├── etc
    │   └── digicert
    │       ├── conf
    │       │   ├── applied_policy.json
    │       │   ├── bootstrap_config.json
    │       │   ├── failed_policy.json
    │       │   ├── metrics.pb
    │       │   ├── pending_policy.json
    │       │   ├── processing_policy.json
    │       │   └── version.txt
    │       ├── keystore
    │       │   ├── ca
    │       │   │   ├── devtm-integration-account-intermediate-ca.crt
    │       │   │   ├── devtm-integration-account-root-ca.crt
    │       │   │   ├── DigiCertGlobalRootCA.crt
    │       │   │   ├── DigiCertGlobalRootG2.crt
    │       │   │   ├── Rendezvous-zone-1-0.crt
    │       │   │   └── Rendezvous-zone-2-0.crt
    │       │   ├── certs
    │       │   │   ├── be_zephy00.crt
    │       │   │   └── te-api-server.pem
    │       │   ├── conf
    │       │   ├── crls
    │       │   ├── keys
    │       │   │   ├── be_zephy00-key.crt
    │       │   │   ├── server_key_gen.pem
    │       │   │   └── te-api-server.pem
    │       │   ├── psks
    │       │   └── req
    │       │       └── issued
    │       ├── scripts
    │       ├── service
    │       │   ├── completed
    │       │   ├── failed
    │       │   ├── processing
    │       │   └── request
    │       └── trustedge.json
    └── tmp

20 directories, 20 files

Navigate to the TrustEdge workspace.

Run the following command:

cd ${MOCN_MSS}

Run the Zephyr build script:

./scripts/ci/trustedge/ci_trustedge_build_zephyr.sh --board esp32s3_devkitc --clean

Navigate to the sample directory.

Run the following command:

cd ./src/examples/zephyr_examples/trustedge_sample

Run the following command to flash the MCUbootloader:

west flash --esp-flash-bootloader build_mcuboot/zephyr/zephyr.bin --esp-boot-address 0x0

Run the following command to flash the TrustEdge binary:

west flash

Navigate to the helper scripts directory:

cd ${MOCN_MSS}
cd ./src/examples/zephyr_examples/trustedge_sample/helper

Run the following command to prepare the file for an EST enrollment. This command creates a new filesystem zip with EST-related files.

./prepare_trustedge_est.sh <path-to-filesystem-zip>

Run a TCP server to allow filesystem and the bootstrap files:

python tcp_server.py --bootstrap <path-to-bootstrap-zip> --filesys <path-to-filesystem-zip>

Run the following command to connect to the ESP32-S3 serial port using a minicom:

sudo minicom -b 115200 -D /dev/ttyUSB0

Run the following command from the UART shell to reboot and connect to a wireless network:

uart:~$ kernel reboot
uart:~$ wifi connect -k <num> -s <SSID> -p <password>

Where:

Run the following command to start TrustEdge:

uart:~$ trustedge start

Run the following command to check the TrustEdge logs:

uart:~$ fs cat /lfs1/log/log.0000

Run the following command to verify if TrustEdge is connected:

uart:~$ trustedge state

Run the following command to verify if TrustEdge is provisioned:

uart:~$ trustedge status