Description

FDO Manufacturing Server container

The server side implementation of the "Device Initialize" protocol, the FDO Manufacturing Server is responsible for signing a device and creating a voucher used for device ownership.

Generate the needed certificates and keys

Install the fdo-admin-cli tool by running the following command:

dnf install fdo-admin-cli

To generate the needed certificates and keys:

 mkdir keys
 for i in "diun" "manufacturer" "device-ca" "owner"; do fdo-admin-tool generate-key-and-cert $i; done

This will populate the 'keys' directory with all the certificates and keys needed to use the various FDO containers. Below is a list of which containers will need which certificates and keys.

fdo-manufacturing-server: diun_key.der, diun_cert.pem, manufacturer_cert.pem, manufacturer_cert.der, owner_cert.pem, device_ca_key.der, device_ca_cert.pem

fdo-rendezvous-server: manufacturer_cert.pem

fdo-owner-onboarding-server: device_ca_cert.pem, owner_key.der owner_cert.pem

fdo-serviceinfo-api-server: None

Usage with Podman

Edit the example configuration file to adjust the paths used on the local system.

podman run -d \
    --name fdo-manufacturing-server \
    -p 8080:8080 \
    -v /local/path/to/keys/:/etc/fdo/keys:Z \
    -v /local/path/to/config:/etc/fdo/manufacturing-server.conf.d/:Z \
    -v /local/path/to/stores:/etc/fdo/stores/:Z \
    registry.redhat.io/rhel9/fdo-manufacturing-server

Ports

8080/tcp

The Manufacturing server listens on this port by default.

Additional Usage Documentation

https://github.com/fedora-iot/fido-device-onboard-rs/blob/main/HOWTO.md

Upstream Documentation

https://fidoalliance.org/specs/FDO/FIDO-Device-Onboard-RD-v1.1-20211214/FIDO-device-onboard-spec-v1.1-rd-20211214.html