Support multiple trusted-ca objects in Tenant API

Tenant API should support multiple trusted-ca objects. This is needed for those use-cases:

• Within a tenant, devices with certificates from different CAs should be supported
• Key Rotation: If a CA certificate expires and a new one gets deployed, during a certain amount of time, both certificates should be accepted

I would recommend to change the data schema to something like:

"trusted-ca": [
  {
    "subject-dn": "CN=devices,O=ACME Corporation",
    "public-key": "aGFsbG8gT21hCg==",
    "not-before": "2015-01-01T00:00:00+0000",
    "not-after": "2025-01-01T00:00:00+0000"
  },
  {
    "subject-dn": "CN=devices,O=ACME Corporation",
    "public-key": "aGFsbG8gT21hMgo=",
    "not-before": "2024-01-01T00:00:00+0000",
    "not-after": "2034-01-01T00:00:00+0000"
  },
}

[sophokles73]

The client (i.e. the protocol adapters) should not bother with certs vs. public keys. We also already agreed that the client should not need to filter on the validity dates because that is already done by the Tenant service implementation. Thus, there is no need to transfer an encoded certificate to the adapter. A manager of the content of the device registry might still be able to upload a certificate for a tenant. The Tenant service implementation may store the certificate in its encoded form or it may extract the subject DN, public key and validity period and store those. In any case, it will always only transfer those public keys and subject DNs to the adapters that are currently valid in response to a request from an adapter …

[b-abel]

@b-abel are you also working on this? I already started working on this issue and might file a PR for it this weekend 😃

Didn’t know that. But no problem, i haven’t done anything substantial yet. I’ll just move on to another topic 😃