By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

AWS IoT Core凭据提供程序需要发送私钥。

0

【以下的问题经过翻译处理】 我正在阅读这些文件，并注意到请求安全令牌的步骤需要客户端向凭证提供程序服务发送其私钥。

这在以下文档中有提到： https://docs.aws.amazon.com/iot/latest/developerguide/authorizing-direct-aws.html https://aws.amazon.com/blogs/security/how-to-eliminate-the-need-for-hardcoded-aws-credentials-in-devices-by-using-the-aws-iot-credentials-provider/

乍一看，我认为这是一个安全漏洞，会破坏首次使用非对称密钥的目的。

如果有人能解释一下这个操作，我将不胜感激。

Topics
Internet of Things (IoT)Security, Identity, & ComplianceAWS Well-Architected Framework
Tags
AWS IoT CoreDevice SecuritySecurity
Language
中文 (简体)
profile picture
EXPERT
rePost Polyglot
asked 6 months ago30 views
1 Answer
0

【以下的回答经过翻译处理】 你好，

私钥 永远不会 被发送到凭证提供程序。它用于与终点建立相互认证 (mTLS) 连接。这使得凭证提供程序能够验证呈现的 X.509 证书。

profile picture
EXPERT
rePost Polyglot
answered 6 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content