dexter submitted this change.

View Change

crypto_utils: log EID and encoded EUM cert instead of decoded cert

When a profile download happens, the eIM automatically tries to check
the EUM (and the eUICC certificate). This is done in order to cache the
public key of the eUICC certificate. For the check, a the root
certificate of the EUM certificate is required. If none is found, an
error is logged with the decoded EUM certificate as context. This
produces a lot of log lines and the decoded certificate contents are
barely readable.

Let's instead log the EID of the eUICC and the EUM certificate in its
encoded form (hexdump). This is much more compact and still gives
eIM operators enough context to track down the problem.

Related: SYS#8100
Change-Id: I33c19fee0bec31b4c6b3c8052976625f3213aac1
---
M src/crypto_utils.erl
1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/crypto_utils.erl b/src/crypto_utils.erl
index 49f5a25..d07b931 100644
--- a/src/crypto_utils.erl
+++ b/src/crypto_utils.erl
@@ -205,14 +205,14 @@
             error
     end.
 
-get_root_cert(EumCertificate, []) ->
+get_root_cert(EumCertificate, EidValue, []) ->
+    {ok, EumCertificateEncoded} = 'PKIX1Explicit88':encode('Certificate', EumCertificate),
     logger:error(
-        "Certificate verification failed, no root certificate found,~nEumCertificate=~p~n", [
-            EumCertificate
-        ]
+        "unable to verify eUICC/EUM certificate, no root certificate for EUM certificate found,~nEidValue=~p,~nEumCertificate=~p~n",
+        [EidValue, utils:binary_to_hex(EumCertificateEncoded)]
     ),
     error;
-get_root_cert(EumCertificate, RootCiCerts) ->
+get_root_cert(EumCertificate, EidValue, RootCiCerts) ->
     [RootCiCert | RootCiCertsTail] = RootCiCerts,
     {ok, RootCiCertPath} = utils:get_priv_file_path(onomondo_eim, RootCiCert),
     {ok, RootCiCertPem} = file:read_file(RootCiCertPath),
@@ -222,12 +222,12 @@
         true ->
             {ok, RootCiCertPem};
         _ ->
-            get_root_cert(EumCertificate, RootCiCertsTail)
+            get_root_cert(EumCertificate, EidValue, RootCiCertsTail)
     end.
 
-verify_euicc_cert(EumCertificate, EuiccCertificate) ->
+verify_euicc_cert(EumCertificate, EuiccCertificate, EidValue) ->
     {ok, RootCiCerts} = application:get_env(onomondo_eim, root_ci_certs),
-    case get_root_cert(EumCertificate, RootCiCerts) of
+    case get_root_cert(EumCertificate, EidValue, RootCiCerts) of
         {ok, RootCiCertPem} ->
             [{'Certificate', RootCiCertBer, not_encrypted}] = public_key:pem_decode(RootCiCertPem),
             {ok, RootCiCert} = 'PKIX1Explicit88':decode('Certificate', RootCiCertBer),
@@ -264,7 +264,7 @@
     end.
 
 store_euicc_pubkey(EumCertificate, EuiccCertificate, EidValue) ->
-    case verify_euicc_cert(EumCertificate, EuiccCertificate) of
+    case verify_euicc_cert(EumCertificate, EuiccCertificate, EidValue) of
         ok ->
             {{'ECPoint', SignPubKey}, {namedCurve, NamedCurve}} = pubkey_from_cert(
                 EuiccCertificate

To view, visit change 43647. To unsubscribe, or for help writing mail filters, visit settings.