[Advanced Security][UploadCertificate] Public key sharing

[MariaYa0091]

Currently UploadCertificate contains the following description:

Is it still valid requirement? I had an impression that there was discussions that device usually creates new key pair for such cases. Could you please clarify.

[bsriramprasad]

Isn't this the case of using PKCS10CSR to create signed certificate and upload the same certificate back to the device?

[MariaYa0091]

For PKCS10CSR use case private key is involved, which is described here:

[HansBusch]

Understand the confusion. It isn't defined how to derive whether a private key is required or not. My guess is the optional key usage extension.
My preference would be to simplify the statements and to solely depend on the existence of a matching private key. The behavior would only differ for corner cases with e.g. certificate usage encrypt when the matching key is already present on the device which doesn't make any sense in real world usage.

[kieran242]

Is there a need for clarification for the "UploadCertificate" documentation to remove the confusion?

[sujithhanwha]

Closing this since the PR is open for this.