catarrh/pysim
1
0
Fork 0
forked from public/pysim
Code Pull Requests Activity

docs: Update osmo-smdpp with pointer to sysmoEUICC1-C2T and SGP.26

Browse Source 
Change-Id: Id031ca48549a3c2ac21c93a169262570843d8e2d
This commit is contained in:
Harald Welte
2024-01-25 19:07:14 +01:00
parent af87cd544f
commit 6dadb6c215
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
docs/osmo-smdpp.rst
View File

@@ -19,6 +19,8 @@ support for profile personalization yet.
osmo-smdpp currently osmo-smdpp currently
* uses test certificates copied from GSMA SGP.26 into `./smdpp-data/certs`, assuming that your osmo-smdppp
would be running at the host name `testsmdpplus1.example.com`
* always provides the exact same profile to every request. The profile always has the same IMSI and * always provides the exact same profile to every request. The profile always has the same IMSI and
ICCID. ICCID.
* **is absolutely insecure**, as it * **is absolutely insecure**, as it
@@ -91,3 +93,20 @@ The LPA must resolve `testsmdpplus1.example.com` to the IP address of your TLS p
It must also accept the TLS certificates used by your TLS proxy. It must also accept the TLS certificates used by your TLS proxy.
Supported eUICC
~~~~~~~~~~~~~~~
If you run osmo-smdpp with the included SGP.26 certificates, you must use an eUICC with matching SGP.26
certificates, i.e. the EUM certificate must be signed by a SGP.26 test root CA and the eUICC certificate
in turn must be signed by that SGP.26 EUM certificate.
sysmocom (sponsoring development and maintenance of pySim and osmo-smdpp) is selling SGP.26 test eUICC
as `sysmoEUICC1-C2T`. They are publicly sold in the `sysmocom webshop <https://shop.sysmocom.de/eUICC-for-consumer-eSIM-RSP-with-SGP.26-Test-Certificates/sysmoEUICC1-C2T>`_.
In general you can use osmo-smdpp also with certificates signed by any other certificate authority. You
just always must ensure that the certificates of the SM-DP+ are signed by the same root CA as those of your
eUICCs.
Hypothetically, osmo-smdpp could also be operated with GSMA production certificates, but it would require
that somebody brings the code in-line with all the GSMA security requirements (HSM support, ...) and operate
it in a GSMA SAS-SM accredited environment and pays for the related audits.