#include <stdlib.h>
#include <stdio.h>
#include <stdbool.h>
#include "include/common/optiga_lib_common.h"
#include "include/optiga_crypt.h"
#include "include/optiga_util.h"
#include "include/pal/pal_os_timer.h"

Data Structures
struct	optiga_protected_update_manifest_fragment_configuration
	Specifies the structure for protected update manifest and fragment configuration. More...
struct	optiga_protected_update_data_configuration
	Specifies the structure for protected update data configuration. More...
struct	optiga_slot_info_t
struct	cert_validation_result_t
	Certificate validation result structure. More...

Macros
#define	DEVICE_CERTIFICATE_OID (0xE0E1U)

Typedefs
typedef struct optiga_protected_update_manifest_fragment_configuration	optiga_protected_update_manifest_fragment_configuration_t
	Specifies the structure for protected update manifest and fragment configuration.
typedef struct optiga_protected_update_data_configuration	optiga_protected_update_data_configuration_t
	Specifies the structure for protected update data configuration.

Enumerations
enum	cert_source_t { CERT_SOURCE_DEVICE = 0xE0E1 , CERT_SOURCE_FACTORY = 0xE0E0 }
	Certificate source type for MQTT TLS connection. More...

Functions
void	read_certificate_from_optiga (uint16_t optiga_oid, char cert_pem, uint16_t cert_pem_length)
void	read_trust_anchor_from_optiga (uint16_t oid, char cert_pem, uint16_t cert_pem_length)
void	write_data_object (uint16_t oid, const uint8_t *p_data, uint16_t length)
bool	optiga_trust_init (void)
int	optiga_verify_cert_key_pair (uint16_t cert_oid, uint16_t key_oid)
bool	optiga_clear_manifest_lock (uint16_t target_oid)
bool	optiga_slot_info (uint16_t oid, optiga_slot_info_t *info)
bool	optiga_slot_info_raw (uint16_t oid, uint16_t anchor, uint32_t version, uint16_t used, uint8_t type)
uint16_t	optiga_slot_manifest_anchor (uint16_t oid)
uint32_t	optiga_slot_payload_version (uint16_t oid)
bool	optiga_trust_open_application (void)
void	optiga_trust_close_application (void)
void	optiga_util_callback (void *context, optiga_lib_status_t return_status)
void	trustm_close (optiga_util_t *util)
optiga_lib_status_t	trustm_gen_ecc_keypair (uint16_t optiga_key_id, optiga_ecc_curve_t curve_id, uint8_t key_usage, bool export_private, uint8_t pub, uint16_t pub_len)
int	optiga_verify_staged_model (const uint8_t *blob, uint32_t blob_len)
optiga_lib_status_t	trustm_ecdsa_sign (optiga_key_id_t oid, const uint8_t digest, uint16_t digest_len, uint8_t sig_raw, uint16_t *sig_raw_length)
bool	optiga_read_factory_uid (char *uid_hex, size_t uid_hex_len)
bool	optiga_read_factory_certificate (char cert_pem, uint16_t cert_pem_length)
bool	optiga_read_device_certificate (char cert_pem, uint16_t cert_pem_length)
bool	trustm_use_factory_certificate (void)
bool	trustm_use_device_certificate (void)
bool	optiga_generate_device_keypair (uint16_t key_oid, uint8_t public_key_der, uint16_t public_key_der_len)
bool	optiga_check_certificate_validity (uint16_t oid, cert_validation_result_t *result)
	Check certificate validity and extract information.
uint32_t	optiga_get_cert_days_until_expiry (uint16_t oid)
	Get days until certificate expiry.
bool	optiga_generate_csr_pem (uint16_t key_oid, const uint8_t public_key_der, uint16_t public_key_der_len, const char subject, char *csr_pem, size_t csr_pem_len)
optiga_lib_status_t	write_device_certificate_and_verify ()
optiga_lib_status_t	protected_update (uint16_t trust_anchor_oid, uint16_t target_key_oid, uint16_t confidentiality_oid)
optiga_lib_status_t	test_metadata_operations (void)

Variables
volatile optiga_lib_status_t	optiga_lib_status

Macro Definition Documentation

◆ DEVICE_CERTIFICATE_OID

#define DEVICE_CERTIFICATE_OID (0xE0E1U)

Typedef Documentation

◆ optiga_protected_update_manifest_fragment_configuration_t

typedef struct optiga_protected_update_manifest_fragment_configuration optiga_protected_update_manifest_fragment_configuration_t

Specifies the structure for protected update manifest and fragment configuration.

◆ optiga_protected_update_data_configuration_t

typedef struct optiga_protected_update_data_configuration optiga_protected_update_data_configuration_t

Specifies the structure for protected update data configuration.

Enumeration Type Documentation

◆ cert_source_t

enum cert_source_t

Certificate source type for MQTT TLS connection.

Enumerator
CERT_SOURCE_DEVICE	TESAIoT Platform Certificate (preferred).
CERT_SOURCE_FACTORY	Infineon Factory Certificate (fallback).

Function Documentation

◆ read_certificate_from_optiga()

void read_certificate_from_optiga	(	uint16_t	optiga_oid,
		char *	cert_pem,
		uint16_t *	cert_pem_length )

◆ read_trust_anchor_from_optiga()

void read_trust_anchor_from_optiga	(	uint16_t	oid,
		char *	cert_pem,
		uint16_t *	cert_pem_length )

◆ write_data_object()

void write_data_object	(	uint16_t	oid,
		const uint8_t *	p_data,
		uint16_t	length )

◆ optiga_trust_init()

bool optiga_trust_init ( void )

◆ optiga_verify_cert_key_pair()

int optiga_verify_cert_key_pair	(	uint16_t	cert_oid,
		uint16_t	key_oid )

◆ optiga_clear_manifest_lock()

bool optiga_clear_manifest_lock ( uint16_t target_oid )

◆ optiga_slot_info()

bool optiga_slot_info	(	uint16_t	oid,
		optiga_slot_info_t *	info )

◆ optiga_slot_info_raw()

bool optiga_slot_info_raw	(	uint16_t	oid,
		uint16_t *	anchor,
		uint32_t *	version,
		uint16_t *	used,
		uint8_t *	type )

◆ optiga_slot_manifest_anchor()

uint16_t optiga_slot_manifest_anchor ( uint16_t oid )

◆ optiga_slot_payload_version()

uint32_t optiga_slot_payload_version ( uint16_t oid )

◆ optiga_trust_open_application()

bool optiga_trust_open_application ( void )

◆ optiga_trust_close_application()

void optiga_trust_close_application ( void )

◆ optiga_util_callback()

void optiga_util_callback	(	void *	context,
		optiga_lib_status_t	return_status )

◆ trustm_close()

void trustm_close ( optiga_util_t * util )

◆ trustm_gen_ecc_keypair()

optiga_lib_status_t trustm_gen_ecc_keypair	(	uint16_t	optiga_key_id,
		optiga_ecc_curve_t	curve_id,
		uint8_t	key_usage,
		bool	export_private,
		uint8_t *	pub,
		uint16_t *	pub_len )

◆ optiga_verify_staged_model()

int optiga_verify_staged_model	(	const uint8_t *	blob,
		uint32_t	blob_len )

◆ trustm_ecdsa_sign()

optiga_lib_status_t trustm_ecdsa_sign	(	optiga_key_id_t	oid,
		const uint8_t *	digest,
		uint16_t	digest_len,
		uint8_t *	sig_raw,
		uint16_t *	sig_raw_length )

◆ optiga_read_factory_uid()

bool optiga_read_factory_uid	(	char *	uid_hex,
		size_t	uid_hex_len )

◆ optiga_read_factory_certificate()

bool optiga_read_factory_certificate	(	char *	cert_pem,
		uint16_t *	cert_pem_length )

◆ optiga_read_device_certificate()

bool optiga_read_device_certificate	(	char *	cert_pem,
		uint16_t *	cert_pem_length )

◆ trustm_use_factory_certificate()

bool trustm_use_factory_certificate ( void )

◆ trustm_use_device_certificate()

bool trustm_use_device_certificate ( void )

◆ optiga_generate_device_keypair()

bool optiga_generate_device_keypair	(	uint16_t	key_oid,
		uint8_t *	public_key_der,
		uint16_t *	public_key_der_len )

◆ optiga_check_certificate_validity()

bool optiga_check_certificate_validity	(	uint16_t	oid,
		cert_validation_result_t *	result )

Check certificate validity and extract information.

Reads certificate from OPTIGA Trust M and validates it against current time. Extracts subject, issuer, validity dates and calculates days until expiry.

Parameters

oid	Certificate OID (0xE0E0 for Factory, 0xE0E1 for Device)
result	Pointer to validation result structure (output)

Returns: true if certificate readable and parseable, false on error

Note: Requires RTC or NTP time synchronization for accurate validation; Uses mbedtls_x509_crt_parse() for X.509 certificate parsing

◆ optiga_get_cert_days_until_expiry()

uint32_t optiga_get_cert_days_until_expiry ( uint16_t oid )

Get days until certificate expiry.

Convenience function to quickly check certificate expiry status.

Parameters

oid	Certificate OID (0xE0E0 or 0xE0E1)

Returns: Days until expiry, 0 if expired or error

◆ optiga_generate_csr_pem()

bool optiga_generate_csr_pem	(	uint16_t	key_oid,
		const uint8_t *	public_key_der,
		uint16_t	public_key_der_len,
		const char *	subject,
		char *	csr_pem,
		size_t	csr_pem_len )

◆ write_device_certificate_and_verify()

optiga_lib_status_t write_device_certificate_and_verify ( )

◆ protected_update()

optiga_lib_status_t protected_update	(	uint16_t	trust_anchor_oid,
		uint16_t	target_key_oid,
		uint16_t	confidentiality_oid )

◆ test_metadata_operations()

optiga_lib_status_t test_metadata_operations ( void )

Test metadata operations for debugging certificate write issues

Performs 5 comprehensive diagnostic tests:

TEST 1: Read metadata from OID 0xE0E1 (device certificate slot)
TEST 2: Test write metadata to OID 0xF1D0 (user data OID)
TEST 3: Display OID 0xE0E1 specification (access conditions from datasheet)
TEST 4: Read Global Lifecycle State (OID 0xE0C0) to check if device is locked
TEST 5: Read and display current device certificate from OID 0xE0E1

Certificate Display includes:

Subject CN (Common Name)
Issuer CN
Valid From/To dates
Serial Number
Certificate size
First 64 bytes of DER data

Usage: Run before CSR workflow to see OLD certificate, then after to see NEW certificate

Returns: OPTIGA_LIB_SUCCESS on success, error code otherwise

Variable Documentation

◆ optiga_lib_status

volatile optiga_lib_status_t optiga_lib_status

extern

Data Structures

Macros

Typedefs

Enumerations

Functions

Variables