Cấu hình your mobile app or IoT device Configure your mobile app or IoT device

const defaultData = { temperatures: [] };


const getCache = (key) => TEMPERATURES.get(key);

const setCache = (key, data) => TEMPERATURES.put(key, data);


async function addTemperature(request) {

  // Pull previously recorded temperatures for this client.

  const ip = request.headers.get("CF-Connecting-IP");

  const cacheKey = `data-${ip}`;

  let data;

  const cache = await getCache(cacheKey);

  if (!cache) {

    await setCache(cacheKey, JSON.stringify(defaultData));

    data = defaultData;

  } else {

    data = JSON.parse(cache);

  }


  // Append the recorded temperatures with the submitted reading (assuming it has both temperature and a timestamp).

  try {

    const body = await request.text();

    const val = JSON.parse(body);


    if (val.temperature && val.time) {

      data.temperatures.push(val);

      await setCache(cacheKey, JSON.stringify(data));

      return new Response("", { status: 201 });

    } else {

      return new Response(

        "Unable to parse temperature and/or timestamp from JSON POST body",

        { status: 400 },

      );

    }

  } catch (err) {

    return new Response(err, { status: 500 });

  }

}


function compareTimestamps(a, b) {

  return -1 * (Date.parse(a.time) - Date.parse(b.time));

}


// Return the 5 most recent temperature measurements.

async function getTemperatures(request) {

  const ip = request.headers.get("CF-Connecting-IP");

  const cacheKey = `data-${ip}`;


  const cache = await getCache(cacheKey);

  if (!cache) {

    return new Response(JSON.stringify(defaultData), {

      status: 200,

      headers: { "content-type": "application/json" },

    });

  } else {

    data = JSON.parse(cache);

    const retval = JSON.stringify(

      data.temperatures.sort(compareTimestamps).splice(0, 5),

    );

    return new Response(retval, {

      status: 200,

      headers: { "content-type": "application/json" },

    });

  }

}


export default {

  async fetch(request, env, ctx) {

    return request.method === "POST"

      ? addTemperature(request)

      : getTemperatures(request);

  },

};

# Generate a private key and CSR for the iOS device.


$ cat <<'EOF' | tee -a csr.json

{

    "hosts": [

        "ios-bootstrap.devices.upinatoms.com"

    ],

    "CN": "ios-bootstrap.devices.upinatoms.com",

    "key": {

        "algo": "rsa",

        "size": 2048

    },

    "names": [{

        "C": "US",

        "L": "Austin",

        "O": "Temperature Testers, Inc.",

        "OU": "Tech Operations",

        "ST": "Texas"

    }]

}

EOF


$ cfssl genkey csr.json | cfssljson -bare certificate


2020/09/27 21:28:46 [INFO] generate received request

2020/09/27 21:28:46 [INFO] received CSR

2020/09/27 21:28:46 [INFO] generating key: rsa-2048

2020/09/27 21:28:47 [INFO] encoded CSR


$ mv certificate-key.pem ios-key.pem

$ mv certificate.csr ios.csr


# Do the same for the IoT sensor.


$ sed -i.bak 's/ios-bootstrap/sensor-001/g' csr.json

$ cfssl genkey csr.json | cfssljson -bare certificate

...

$ mv certificate-key.pem sensor-key.pem

$ mv certificate.csr sensor.csr


# now ask that these CSRs be signed by the private CA issued for your zone

# we need to replace actual newlines in the CSR with ‘\n’ before POST’ing

$ CSR=$(cat ios.csr | perl -pe 's/\n/\\n/g')

$ request_body=$(< <(cat <<EOF

{

  "validity_days": 3650,

  "csr":"$CSR"

}

EOF

))


# save the response so we can view it and then extra the certificate

$ curl https://api.cloudflare.com/client/v4/zones/{zone_id}/client_certificates \

--header "X-Auth-Email: <EMAIL>" \

--header "X-Auth-Key: <API_KEY>" \

--header "Content-Type: application/json" \

--data "$request_body" > response.json


$ cat response.json | jq .


{

  "success": true,

  "errors": [],

  "messages": [],

  "result": {

    "id": "7bf7f70c-7600-42e1-81c4-e4c0da9aa515",

    "certificate_authority": {

      "id": "8f5606d9-5133-4e53-b062-a2e5da51be5e",

      "name": "Cloudflare Managed CA for account 11cbe197c050c9e422aaa103cfe30ed8"

    },

    "certificate": "-----BEGIN CERTIFICATE-----\nMIIEkzCCA...\n-----END CERTIFICATE-----\n",

    "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIDITCCA...\n-----END CERTIFICATE REQUEST-----\n",

    "ski": "eb2a48a19802a705c0e8a39489a71bd586638fdf",

    "serial_number": "133270673305904147240315902291726509220894288063",

    "signature": "SHA256WithRSA",

    "common_name": "ios-bootstrap.devices.upinatoms.com",

    "organization": "Temperature Testers, Inc.",

    "organizational_unit": "Tech Operations",

    "country": "US",

    "state": "Texas",

    "location": "Austin",

    "expires_on": "2030-09-26T02:41:00Z",

    "issued_on": "2020-09-28T02:41:00Z",

    "fingerprint_sha256": "84b045d498f53a59bef53358441a3957de81261211fc9b6d46b0bf5880bdaf25",

    "validity_days": 3650

  }

}


$ cat response.json | jq .result.certificate | perl -npe 's/\\n/\n/g; s/"//g' > ios.pem


# Now ask that the second client certificate signing request be signed.


$ CSR=$(cat sensor.csr | perl -pe 's/\n/\\n/g')

$ request_body=$(< <(cat <<EOF

{

  "validity_days": 3650,

  "csr":"$CSR"

}

EOF

))


$ curl https://api.cloudflare.com/client/v4/zones/{zone_id}/client_certificates \

--header "X-Auth-Email: <EMAIL>" \

--header "X-Auth-Key: <API_KEY>" \

--header "Content-Type: application/json" \

--data "$request_body" | perl -npe 's/\\n/\n/g; s/"//g' > sensor.pem

$ openssl pkcs12 -export -out bootstrap-cert.pfx -inkey ios-key.pem -in ios.pem

Enter Export Password:

Verifying - Enter Export Password:

import requests

import json

from datetime import datetime


def readSensor():


    # Takes a reading from a temperature sensor and store it to temp_measurement


    dateTimeObj = datetime.now()

    timestampStr = dateTimeObj.strftime('%Y-%m-%dT%H:%M:%SZ')


    measurement = {'temperature':str(temp_measurement),'time':timestampStr}

    return measurement


def main():


    print("Cloudflare API Shield [IoT device demonstration]")


    temperature = readSensor()

    payload = json.dumps(temperature)


    url = 'https://shield.upinatoms.com/temps'

    json_headers = {'Content-Type': 'application/json'}

    cert_file = ('/etc/ssl/certs/sensor.pem', '/etc/ssl/private/sensor-key.pem')


    r = requests.post(url, headers = json_headers, data = payload, cert = cert_file)


    print("Request body: ", r.request.body)

    print("Response status code: %d" % r.status_code)

Cloudflare API Shield [IoT device demonstration]

Request body:  {"temperature": "36.5", "time": "2020-09-28T15:52:19Z"}

Response status code: 403

Cloudflare API Shield [IoT device demonstration]

Request body:  {"temperature": "36.5", "time": "2020-09-28T15:56:45Z"}

Response status code: 201

{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/ssl/","name":"SSL/TLS"}},{"@type":"ListItem","position":3,"item":{"@id":"/ssl/client-certificates/","name":"Client certificates (mTLS)"}},{"@type":"ListItem","position":4,"item":{"@id":"/ssl/client-certificates/configure-your-mobile-app-or-iot-device/","name":"Configure your mobile app or IoT device"}}]}