Ashin Walpola
0e9525162d
obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but that tree was gitignored, so a clone of this repository could not build the firmware it ships. It is now committed here as ordinary files in its own folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP bridge's signature verification (--trust) used on the bench. Nothing is fetched from or pushed to the colleague's repository; this repository and its remotes carry everything. The folder's own .gitignore keeps build output, downloaded components and private key material out, as it did there; the committed file set is identical to that repository's tracked files. The ESP32-C5 is still flashed from obu-firmware/, which only takes vanetza-idf from microbu-esp32c5/, so the two stay separate folders. FLASHING.md says how to take a newer version of the colleague's tree (copy it over the folder, rebuild, test, commit).
Vanetza PKI Client
Our PKI client allows you to interact with any ETSI compliant C-ITS PKI provider. Ideally, your PKI provider is listed in the European Certificate Trust List (ECTL).
In the examples below we use Eviden's L0 PKI (c-its-pki.eu). However, this tool is not limited to any particular PKI provider!
Enrol at PKI included in ECTL
- Fetch latest TLM from CPOC
pki cpoc tlm fetch
Added TLM certificate "EU-TLM_L0" (8FFE810BDB0D71E6)
Writes ~/.local/share/vanetza/pki/certificates/8FFE810BDB0D71E6.tlm
- Fetch ECTL from CPOC
pki cpoc ectl fetch
Stored ECTL
Writes ~/.local/share/vanetza/pki/ectl.ctl and populates certificates/*.rca with Root CA certificaties listed in ECTL.
- Select Root CA for your station
pki station set-root-ca 1B5CB4BEBE6FE9E9
Found Root CA certificate in cache.
- Fetch CTL from Distribution Centre (DC) of your Root CA
pki dc info
DC URL: https://0.eu-dc.l0.c-its-pki.eu/
Prints the DC URL as found in the ECTL for the previously selected Root CA.
pki dc getctl --print
- EA: http://0.eu-ea.l0.c-its-pki.eu/ [AA] \
- AA: http://0.eu-aa.l0.c-its-pki.eu/
Fetched CTL matches Root CA digest
CTL is valid. Added to local trust list storage.
Writes ~/.local/share/vanetza/pki/ctls/1B5CB4BEBE6FE9E9.ctl
- Perform initial enrolment at EA
Initial enrolment needs a canonical (bootstrap) key pair. In a real deployment this key is provisioned by the station manufacturer. For testing you can generate one:
pki key generate --out ~/station_key.pem
Wrote /home/user/station_key.pem
Key type: BrainpoolP256r1
Canonical public key: 021234567890ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF
Use --key-type to pick a curve (BrainpoolP256r1 (default), NistP256, BrainpoolP384r1) and --force to overwrite an existing file.
pki enrol init --canonical-id station_name --canonical-keyfile ~/station_key.pem
Root CA 1B5CB4BEBE6FE9E9
Canonical identifier: station_name
Canonical public key X=1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF1234567890ABCDEF
Enroling against EA certificate: D07F4E6D4D1DFA70
Enroling at EA URL: http://0.eu-ea.l0.c-its-pki.eu/
Stored new EC with HashedId8 = 1234567890ABCDEF
Station can sign with received EC
- Check your station's state
pki station
Canonical identifier: station_name
Enrolled: yes
EC digest: 1234567890ABCDEF
EC certificate: [available]
Root CA: 1B5CB4BEBE6FE9E9
DC URL: https://0.eu-dc.l0.c-its-pki.eu/
Fetch Authorization Tickets (ATs) from PKI's AA
Your station needs to be enrolled with valid EC certificate before you can retrieve ATs.
The following command fetches a single AT with default settings.
The command line option --permission is required at least once to determine the requested AT application permissions.
However, it is more convenient to set these permissions in the local configuration file (~/.config/vanetza/pki.cfg):
[authorization.request]
permission = ["36:01FFFC", "37:01FFFFFF", "141"]
pki at request
Authorizing against AA AF65A276F2D4EBC9 at http://0.eu-aa.l0.c-its-pki.eu/
Stored new AT ABCDEF1234567890
ABCDEF1234567890 [valid now]
valid: 2026-06-06 07:06:29 until 2026-06-13 07:06:29
permissions: 36:01FFFC 37:01FFFFFF 141