Secure VPN client registration

Created 08/24/2026 10:32 · Last modified 08/24/2026 11:41

Ensure that clients connecting to the VPN are able to do so in a secure manner

The intent is that once the use of the VPN has been proven with test clients locally, as part of regular updates to clients, these will be progressively migrated from the existing mechanism of connection to the support servers to use the VPN instead. Many of the current clients are remote - which requires a secure means for the remote clients to register with the VPN. Manual configuration of migrated clients for the Wireguard server/s config is not practical. Clients currently send telemetry data via mqtt (AWS IoT Core). An existing secure mechanism exists to have clients registered (and reregistered if necessary) and issued with the certificates needed to connect and publish to mqtt. As part of this, a client specific private key is provided to the client during registration. We will make use of the existing private key known to already exist on the clients to sign a JWT that will be sent along with the clients Wireguard Public Key to a new vpn registration API endpoint. The AWS IoT Core Certificate can be queried for the public key associated with the certificate. This public key can then be used to validate that the JWT sent by the client was signed with the private key issued to the client. The API will use the JWT to verify that the registration request has come from the client and has not been spoofed by another client. All APIs are secured with TLS, so the end to end validity of the request/response is sound. The vpn-registration will provide to the caller the Wireguard public key for the Wireguard instances, the allowed IPs the client is able to access within the VPN and the IP address for the Wireguard endpoint. The vpn-registration API will be deployed into AWS API Gateway along side the existing registration API used to register clients for access to AWS IoT Core.

Child notes

Fetch of AWS IoT Core Thing Principals

Created 08/24/2026 12:18 · Modified 08/25/2026 14:39

The Certificate/s attached to an IoT Core Thing exist as Principals recorded against the Thing. To be able to get all Principals that are associated with a Thing the following could be used ***Interface*** ``` public interface IIotClient { Task<List<string>> GetThingPrincipalsAsync(string thingName); } ``` ***Implementation*** ``` public class IoTClient : IIotClient { private readonly Amazon.IoT.AmazonIoTClient _awsIoTClient; public async Task<List<string>> GetThingPrincipalsAsync(string thingName) { var retVal = new List<string>(); try { var principalRequest = new Amazon.IoT.Model.ListThingPrincipalsRequest { ThingName = thingName }; var principalResponse = await _awsIoTClient.ListThingPrincipalsAsync(principalRequest); retVal.AddRange(principalResponse.Principals); } catch (Exception e) { _logger?.Error(e.ToString()); } return retVal; } } ```

Back to Notes