You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: source/Tutorials/Advanced/Security/The-Keystore.rst
+8-6Lines changed: 8 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,6 +21,8 @@ Understanding the security keystore
21
21
Background
22
22
----------
23
23
24
+
Before proceeding ensure you have completed the :doc:`Introducing-ros2-security` tutorial.
25
+
24
26
The ``sros2`` package can be used to create keys, certificates and policies necessary to enable ROS 2 security.
25
27
However, the security configuration is extrememly flexible.
26
28
A basic understanding of the ROS 2 Security Keystore will allow integration with an existing PKI (Public Key Infrastructure) and managment of sensitive key materials consistent with organizational policies.
@@ -41,7 +43,7 @@ For this tutorial, we use the directory ``~/sros2_demo/demo_keystore``.
41
43
Public Key Materials
42
44
^^^^^^^^^^^^^^^^^^^^
43
45
44
-
You will find three encryption certificates in the public directory at ``~/sros2_demo/demo_keys/public``; however, the identity and permissions certificates are actually just a link to the Certificate Authority (CA) certificate.
46
+
You will find three encryption certificates in the public directory at ``~/sros2_demo/demo_keystore/public``; however, the identity and permissions certificates are actually just a link to the Certificate Authority (CA) certificate.
45
47
46
48
In a public key infrastructure, the `Certificate Authority <https://en.wikipedia.org/wiki/Certificate_authority>`_ acts as a trust anchor: it validates the identities and permissions of participants.
47
49
For ROS, that means all the nodes that participate in the ROS graph (which may extend to an entire fleet of individual robots).
@@ -58,7 +60,7 @@ Use ``openssl`` to view this x509 certificate and display it as text:
58
60
59
61
.. code-block:: bash
60
62
61
-
cd~/sros2_demo/demo_keys/public
63
+
cd~/sros2_demo/demo_keystore/public
62
64
openssl x509 -in ca.cert.pem -text -noout
63
65
64
66
The output should look similar to the following::
@@ -106,7 +108,7 @@ Since this is a public certificate, it can be freely copied as needed to establi
106
108
Private Key Materials
107
109
^^^^^^^^^^^^^^^^^^^^^
108
110
109
-
Private key materials can be found in the keystore directory ``~/sros2_demo/demo_keys/private``.
111
+
Private key materials can be found in the keystore directory ``~/sros2_demo/demo_keystore/private``.
110
112
Similar to the ``public`` directory, this contains one certificate authority key ``ca.key.pem`` and symbolic links to it to be used as both an Identity and a Permissions CA private key.
111
113
112
114
.. warning::
@@ -128,7 +130,7 @@ Use the following command to show details about this elliptic curve private key:
128
130
129
131
.. code-block:: bash
130
132
131
-
cd~/sros2_demo/demo_keys/private
133
+
cd~/sros2_demo/demo_keystore/private
132
134
openssl ec -in ca.key.pem -text -noout
133
135
134
136
Your output should look similar to the following::
@@ -154,7 +156,7 @@ In addition to the private key itself, note that the public key is listed, and i
154
156
Domain Governance Policy
155
157
^^^^^^^^^^^^^^^^^^^^^^^^
156
158
157
-
Find the domain governance policy in the enclave directory within the keystore, ``~/sros2_demo/demo_keys/enclaves``.
159
+
Find the domain governance policy in the enclave directory within the keystore, ``~/sros2_demo/demo_keystore/enclaves``.
158
160
The ``enclave`` directory contains XML governance policy document ``governance.xml``, as well as a copy of the document which has been signed by the Permissions CA as ``governance.p7s``.
159
161
160
162
The ``governance.p7s`` file contains domain-wide settings such as how to handle unauthenticated participants, whether to encrypt discovery, and default rules for access to topics.
@@ -211,7 +213,7 @@ Begin with a new terminal session and enable security with the keystore created
0 commit comments