Package: wintergreen
THIS REPOSITORY IS A WORK IN PROGRESSIF YOU SEE THIS MESSAGE DO NOT UNDER ANY CIRCUMSTANCE DELETE INFRASTRUCTURE HOPING THAT WINTERGREEN CAN REBUILD ITWe're working on it.PurposeThe responsibility of Wintergreen is to create and manage client-side SSL certificates for authenticating IoT devices with cloud services.Automate device registry in AWS IoT because it sucks.wintergreenis a command line utility that provides mechanisms to automate cumbersome tasks related to signing and registering AWS IoT Thing device certificates.What it doesProvide a quick way to develop with a security-first mindset regarding your IoT web infrastructure by allowing you to avoid the hassle of generating and certs and associating them with your infrastructureWhat it doesn't doProvide a secure pattern for managing device certificates in a hardware production setting.  It does not give you a secure means for allowing a third party manufacturer to generate and/or load certificates onto hardware.RequirementsAs Wintergreen manipulates AWS resources, an AWS account is required.Wintergreen leverages boto3 and acts on the users behalf to create and manipulate resources in AWS.
The user should have AWS credentials set in their environment. In order to check this, you might use the AWS CLI and runaws sts get-caller-identity. This is the user wintergreen will leverage.Installing the CLIpip install wintergreenRunInitializeInitialization meansCreating a ThingTypeCreating a RootCA cert/key pairRegistering that RootCA with AWSCreating a Just-in-time Provisioning roleExample:poetry run wintergreen init -t my-cool-thingCheck your~/.wintergreendirectory to see a subdirectory formy-cool-thing$wintergreeninit--help
Usage:wintergreeninit[OPTIONS]Options:-t,--thing-typeTEXTAWSIoTthingtype[required]-p,--platform[aws|local]PlatformtouploadrootCA[required]-a,--algorithm[rsa|ec]Encryptionalgorithmssupported[required]-c,--countryTEXTCountrycode(2-letter)touseforprovisioningcertsi.e.US[required]-f,--fqdnTEXTDomainoftheorganizationtouseintheCAe.g.verypossible.com-o,--organizationTEXTOrganizationnamei.e.Very-s,--stateTEXTStateorProvincecode(2-letter)touseforprovisioningcertsi.e.TN-l,--localityTEXTLocalitytouseforprovisioningcertsi.e.Chattanooga-u,--unitTEXTOrganizationalunittouseforprovisioningcertsi.e.Engineering-d,--daysINTEGERDaysuntilCAwillexpire[default:365]-k,--key-sizeINTEGER[default:2048]--helpShowthismessageandexit.

Outputs:{"platform_response":{"thingTypeName":"thing_type","thingTypeArn":"arn:aws:iot:us-east-1:...","thingTypeId":"...","jitpRoleArn":"arn:aws:iam::...","certificateArn":"arn:aws:iot:us-east-1:..."},"success":true,"platform":"aws"}Provision a new deviceProvisioning a device means generating a certificate/key pair to be used for the device to authenticate with AWS IoT.$wintergreenprovision--help
Usage:wintergreenprovision[OPTIONS]Options:-t,--thing-typeTEXTSameasthething-typethatwaschoseninthe`init`step.-cn,--common_nameTEXTDefaultstoaUUIDv4-c,--countryTEXT[required]-o,--organizationTEXT-s,--stateTEXT-l,--localityTEXT-u,--unitTEXT-d,--daysINTEGERDaysuntilcertificatewillexpire[default:365]-k,--key-sizeINTEGER[default:2048]-n,--numberINTEGERNumberofcertificatestoprovision[default:1]-v,--verbosityVerbosity,addv'sformore.--helpShowthismessageandexit.

Outputs(dependsonverbosity):
common_name1
common_name2
Generated2certificate(s)These will be written as files scoped by date into your.wintergreendirectory. If you use the-nargument, it will generate a unique uuid for each cert and put all of the certs generated in their own folder. You'll also see an output.csv which contains a table of all the certs generated on this run.Verifying if your provisioned cert can connectAfter running theprovisioncommand the cert/key will be saved in a directory named after the thing-type and common name asdeviceCertPlusCACert.crtanddeviceKey.key$wintergreenverify--help
Usage:wintergreenverify[OPTIONS]Options:-p,--platform[aws|local]PlatformtouploadrootCA[required]-t,--thing-typeTEXTAWSIoTthingtype[required]-cn,--common_nameTEXTPathtoprivatekey[required]--helpShowthismessageandexit.

Outputs(dependingonsuccess):
Certificateverifiedontheawsplatform!(exitcode0)Unabletoverifycertificateontheawsplatform...(exitcode1)Get info about your wintergreen-provisioned devices$wintergreeninfo--help
Usage:wintergreeninfo[OPTIONS]Options:-t,--thing-typeTEXTThingtypetoreceiveinfoabout-cn,--common_nameTEXTCommonnametoreceiveinfoabout--helpShowthismessageandexit.Check the thing types you have created:$wintergreeninfo
totalthingtypes:3foo
baz
barCheck the things you have provisioned for a given thing type:$wintergreeninfo-tfoo
encryptionalgorithm:rsa
totalthings:3a33bd27d-6511-4962-8aae-ad2b569b5904
9742c666-e6c0-4410-8ff3-edfe2d1da37b
d43c2e98-4559-45e3-bae5-271406936fbbGet info about a specific thing you have provisioned:$wintergreeninfo-tfoo-cna33bd27d-6511-4962-8aae-ad2b569b5904{"date":"2019-12-11","common_name":"a33bd27d-6511-4962-8aae-ad2b569b5904","country":"US","fqdn":"","locality":"","organization":"","state":"","unit":""}The Full Workflow$wintergreeninit-texample-thing{"platform_response":{"thingTypeName":"example-thing","thingTypeArn":"arn:aws:iot:us-east-1:...","thingTypeId":"...","jitpRoleArn":"arn:aws:iam::...","certificateArn":"arn:aws:iot:us-east-1:..."},"success":true,"platform":"aws"}$wintergreenprovision-texample-thing-v
some-uuid-common-name

$wintergreenverify-texample-thing-cnsome-uuid-common-name
Certificateverifiedontheawsplatform!

$wintergreeninfo
totalthingtypes:1example-thingDeveloping WintergreenTo contribute to the project, please follow thecontributor instructions.