Set Up Client-Server Machines for Production

​

Client-server configuration

​

Prerequisites

• A Windows 10 server machine with a USB port to connect the HSM key and a secure data store to store information about provisioned devices.
• Windows 10 client machines with a USB port to connect to the serial port on the module.
• Set the system time to the current real time on both the server and the client machines.
• Access to the ACK SDK tools package provided by your ACK support engineer.
  To start a project, see apply for an ACK project.
• Client-Server network with multiple clients and a secured server connected to the same local Wi-Fi or wired network. Configure the network firewall to reject HTTPS requests from outside the network, and don’t expose your server machine to the public network.
• (Recommended) Within your local network, to increase security, set up a virtual local area network (VLAN) that contains only your server and client machines. A VLAN prevents devices in the same network from making HTTPS requests to your server.

​

Steps to configure server and client machines

1. Install ACK SDK tools.
2. Install Python cryptographic token interface.
3. Install HSM software.
4. Set up the server.
5. Set up client machines.
6. Start the server.

​

Step 1: Install ACK SDK tools

pip --version

1. To download the ACK SDK tools package, navigate to the tools folder in the AWS S3 bucket, and then download the ACK_SDK_Tools-matter zip file.
2. To extract the files into a destination folder, enter the following command in a Windows terminal.

unzip ACK_SDK_Tools-matter.zip -d <destination folder>

3. To install the acksdktools package, navigate to the destination folder, and then, enter the following command.

pip install .

4. To verify the ACK SDK tools installed correctly, enter the following command.

pip list

5. Verify that you see the acksdktools package in the list.

​

Step 2: Install Python cryptographic token interface

1. Open Microsoft C++ Build Tools, and then, to download the Visual Studio Installer, click Download Build Tools.
2. Open the Visual Studio Installer, and then, under the Workloads tab, check the Desktop development with C++ installation option. Don’t select any additional options.
3. Click Install.
4. Clone the python-pkcs11 source code to any location.
5. In a terminal window, navigate to the new python-pkcs11 folder, and then enter the following commands at the command prompt.

python setup.py build
python setup.py install

6. To verify a successful installation, enter the following command.

pip install python-pkcs11

7. Verify that you see the following result.
   Requirement already satisfied: python-pkcs11 in ...
8. In a convenient place, such as Notepad on Windows, paste the directory path where you installed the package.
   The default directory is C:\Program Files\OpenSC Project\OpenSC\pkcs11\onepin-opensc-pkcs11.dll.

​

Step 3: Install HSM software

C:\\Program Files\\OpenSC Project\\OpenSC\\tools

​

Step 4: Set up the server

1. Set the time on the computer hosting the server to the current real time.
2. To find the local IP address of the server, enter the following command in a Windows PowerShell terminal window.

(Test-Connection -ComputerName $env:ComputerName -Count 1).IPV4Address.IPAddressToString

3. Generate a CA certificate.
   You can find the generated certificate in <hostname>.pem.

servertools generate-ca -ip <ip address of server> --expiration <Number of days for cert to be valid>

4. Generate authentication tokens for the client machines to connect to the server.

servertools generate-token -d <device_type> --device-type-data-path <path/to/data/folder>

5. Create a folder to store the control logs, audit logs (for Matter), and the database of issued DSNs.
   Create one folder per device type. Example for device type ID ABCD1234: C:\Users\user1\Documents\ACKserver\ABCD1234
   Make sure that the HTTPS user has read and write access to the folder.
6. To create SFTP upload and feedback endpoints for control logs, follow the instructions on the FFS > Control Logs console.
7. In a convenient place, such as Notepad on Windows, paste the upload and feedback endpoints and the control log passphrase. You use these to upload the control files to Amazon.

​

Step 5: Set up client machines

1. Set the time on the client machine to the current real time.
2. Connect the client machine to the module by using screen or PuTTY.
   For details, see Connect your host machine to the development kit.
3. Download the Provisioning configuration file that you generated for the prototype, ProvisioningInfo_<device_type>.conf.
4. Securely copy <hostname>.pem from the server to the client machine.
   You can find the generated certificate on the server.
5. Securely copy a token file from the server to the client machine. Don’t add the same token file to more than one client.
   You can find the token files in path/to/data/folder on the server.
6. Repeat steps 1–5 for each client machine.

​

Step 6: Start the server

ackserver --dry-run --host 0.0.0.0 -p 5000 -d <device_type> --device-type-data-path <path/to/data/folder> --ca-path <path to certificate> --ca-key-path <path to certificate key> -l DEBUG --hsm <smartcard|yubi>

python -c "import os, requests;os.environ['REQUESTS_CA_BUNDLE']=input('Path to hostname-cert.pem file: ').strip();print(requests.get(f'https://{input(\"Host name: \").strip()}:{input(\"Port: \").strip()}/generate_dsn', headers={'Authorization': f'Bearer {open(input(\"Path to token txt file: \").strip()).read().strip()}'}).text)"

yubihsm-connector -d

ackserver --dry-run --host 0.0.0.0 -p 5000 -d <device_type> --device-type-data-path <path/to/data/folder> --ca-path <path to certificate> --ca-key-path <path to certificate key> -l DEBUG --hsm <smartcard|yubi> <--opensc_module|--yubihsm-url>

​

Stop the ACK server

​

Related topics

• Building Matter
• Manufacture your ACK-based Matter Device
• Provision ACK Modules for Production
• Upload Production Logs
• Set Up Your Development Environment for Prototypes