dexter has uploaded this change for review.

View Change

crypto_utils: log EID instead of entire EUM certificate

When a profile download happens, the eIM automatically tries to check
the EUM and the eUICC certificate. This is done in order to cache the
public key of the eUICC certificate. For the check, a suitable root
certificate is required. If none is found, an error is logged with the
entire EUM certificate as context. Let's instead log the EID of the
eUICC that caused the problem, which is much more helpful then just
a certificate dump that is barely readable.

Related: SYS#8100
Change-Id: I33c19fee0bec31b4c6b3c8052976625f3213aac1
---
M src/crypto_utils.erl
1 file changed, 7 insertions(+), 9 deletions(-)

git pull ssh://gerrit.osmocom.org:29418/onomondo-eim refs/changes/47/43647/1

diff --git a/src/crypto_utils.erl b/src/crypto_utils.erl
index 49f5a25..0097074 100644
--- a/src/crypto_utils.erl
+++ b/src/crypto_utils.erl
@@ -205,14 +205,12 @@
             error
     end.
 
-get_root_cert(EumCertificate, []) ->
+get_root_cert(_, EidValue, []) ->
     logger:error(
-        "Certificate verification failed, no root certificate found,~nEumCertificate=~p~n", [
-            EumCertificate
-        ]
+        "unable to verify eUICC/EUM certificate, no suitable root certificate found,~nEidValue=~p~n", [EidValue]
     ),
     error;
-get_root_cert(EumCertificate, RootCiCerts) ->
+get_root_cert(EumCertificate, EidValue, RootCiCerts) ->
     [RootCiCert | RootCiCertsTail] = RootCiCerts,
     {ok, RootCiCertPath} = utils:get_priv_file_path(onomondo_eim, RootCiCert),
     {ok, RootCiCertPem} = file:read_file(RootCiCertPath),
@@ -222,12 +220,12 @@
         true ->
             {ok, RootCiCertPem};
         _ ->
-            get_root_cert(EumCertificate, RootCiCertsTail)
+            get_root_cert(EumCertificate, EidValue, RootCiCertsTail)
     end.
 
-verify_euicc_cert(EumCertificate, EuiccCertificate) ->
+verify_euicc_cert(EumCertificate, EuiccCertificate, EidValue) ->
     {ok, RootCiCerts} = application:get_env(onomondo_eim, root_ci_certs),
-    case get_root_cert(EumCertificate, RootCiCerts) of
+    case get_root_cert(EumCertificate, EidValue, RootCiCerts) of
         {ok, RootCiCertPem} ->
             [{'Certificate', RootCiCertBer, not_encrypted}] = public_key:pem_decode(RootCiCertPem),
             {ok, RootCiCert} = 'PKIX1Explicit88':decode('Certificate', RootCiCertBer),
@@ -264,7 +262,7 @@
     end.
 
 store_euicc_pubkey(EumCertificate, EuiccCertificate, EidValue) ->
-    case verify_euicc_cert(EumCertificate, EuiccCertificate) of
+    case verify_euicc_cert(EumCertificate, EuiccCertificate, EidValue) of
         ok ->
             {{'ECPoint', SignPubKey}, {namedCurve, NamedCurve}} = pubkey_from_cert(
                 EuiccCertificate

To view, visit change 43647. To unsubscribe, or for help writing mail filters, visit settings.