Skip to content

feat: warn users about invalid certificate common name for Cumulocity connections#4052

Merged
reubenmiller merged 1 commit intothin-edge:mainfrom
reubenmiller:feat-warn-invalid-common-name
Mar 18, 2026
Merged

feat: warn users about invalid certificate common name for Cumulocity connections#4052
reubenmiller merged 1 commit intothin-edge:mainfrom
reubenmiller:feat-warn-invalid-common-name

Conversation

@reubenmiller
Copy link
Copy Markdown
Contributor

@reubenmiller reubenmiller commented Mar 16, 2026

Proposed changes

Improve the warning for users that have generated the device certificate using external command (e.g. not tedge cert create). In this scenerio the user doesn't get warning during the cert creation, so they are unaware of the problem.

Now the tedge connect c8y will display a warning if an invalid Common Name is detected at connection time, though it will not prevent trying to connect to Cumulocity (in case if this restriction is lifted at some point).

It is only valid for Cumulocity connections as Cumulocity has a defined list of allowed characters in the Common Name.

Below is an example of the warning that is shown to users:

# tedge connect c8y
Connecting to Cumulocity:
        mapper configuration file: /etc/tedge/tedge.toml
        device id: TST_develop_chalky_bullet:invalid
        cloud profile: <none>
        cloud host: example.cumulocity.com:8883
        auth type: Certificate
        certificate file: /etc/tedge/device-certs/tedge-certificate.pem
        cryptoki: off
        bridge: mosquitto
        service manager: systemd
        mosquitto version: 2.0.11
        proxy: Not configured
warning: The device certificate Common Name may not be accepted by the cloud: The string '"TST_develop_chalky_bullet:invalid"' contains characters which cannot be used in a name [use only A-Z, a-z, 0-9, ' = ( ) , - . ? % * _ ! @]
Creating device in Cumulocity cloud... ✗
error: Connection error while creating device in Cumulocity: Mqtt state: Mqtt serialization/deserialization error: IO: received fatal alert: CertificateUnknown: Mqtt serialization/deserialization error: IO: received fatal alert: CertificateUnknown: IO: received fatal alert: CertificateUnknown: received fatal alert: CertificateUnknown

Types of changes

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Improvement (general improvements like code refactoring that doesn't explicitly fix a bug or add any new functionality)
  • Documentation Update (if none of the other choices apply)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Paste Link to the issue

#3855

Checklist

  • I have read the CONTRIBUTING doc
  • I have signed the CLA (in all commits with git commit -s. You can activate automatic signing by running just prepare-dev once)
  • I ran just format as mentioned in CODING_GUIDELINES
  • I used just check as mentioned in CODING_GUIDELINES
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)

Further comments

@reubenmiller reubenmiller temporarily deployed to Test Pull Request March 16, 2026 21:12 — with GitHub Actions Inactive
@reubenmiller reubenmiller added theme:certificates Theme: Device certificate topics theme:c8y Theme: Cumulocity related topics labels Mar 16, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 16, 2026

Robot Results

✅ Passed ❌ Failed ⏭️ Skipped Total Pass % ⏱️ Duration
860 0 3 860 100 2h39m34.380472s

@codecov
Copy link
Copy Markdown

codecov Bot commented Mar 16, 2026

Codecov Report

❌ Patch coverage is 88.29787% with 11 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
crates/core/tedge/src/cli/connect/command.rs 88.29% 10 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Comment thread crates/core/tedge/src/cli/connect/command.rs
Comment thread crates/core/tedge/src/cli/connect/command.rs Outdated
Comment thread crates/core/tedge/src/cli/connect/command.rs
Copy link
Copy Markdown
Contributor

@didier-wenzek didier-wenzek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

Comment thread crates/core/tedge/src/cli/connect/command.rs
… connections

Signed-off-by: reubenmiller <reuben.d.miller@gmail.com>
@reubenmiller reubenmiller force-pushed the feat-warn-invalid-common-name branch from 22206de to 0caaef5 Compare March 18, 2026 09:36
@reubenmiller reubenmiller temporarily deployed to Test Pull Request March 18, 2026 09:36 — with GitHub Actions Inactive
@reubenmiller reubenmiller added this pull request to the merge queue Mar 18, 2026
Merged via the queue into thin-edge:main with commit 0fe2019 Mar 18, 2026
34 checks passed
@reubenmiller reubenmiller deleted the feat-warn-invalid-common-name branch March 18, 2026 13:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

theme:c8y Theme: Cumulocity related topics theme:certificates Theme: Device certificate topics

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants