I’m trying to understand a series of steps for an authentication system I want to replicate. The steps are executed by this script. To sum up, it does the following:
It runs in a Raspberry Pi and the main objective is to register and login the device in a server.
- First, runs
opensslin the RPI to generate a private key.
- Then, it requests the server a token for the new device.
- With the token and the private key, generates a certificate signing request, again with
- Finally, submits a “CSR with activation request” to the server API that receives a certificate in case of success.
I understand all steps except number 4.
- What does the server do in this step to validate the request?
- And how it generates the certificate (is this the self-signed certificate?)?
- Finally, how will this be used in the future for the authentication process (asking here for the general idea, not the code)?