Wassup folks!
I have implanted my FlexSecure and I am awaiting to implant my Apex Flex in the future (but do have both in my possession at the moment).
FIDO2 works perfectly on the Apex Flex, due to the secure nature of Fidesmo and FIDO2 being configured by VivoKey. I would like, as close as possible, to make my own certification for FIDO2 and try to make it as official as I can, for a single entity.
I’ve started by taking a look at the fantastic GitHub page by DangerousThings called the Fido-attestation-loader:
https://github.com/DangerousThings/fido-attestation-loader/tree/master
And here is where I started having loads of questions. I can see that there is a settings file to configure, and this contains details like:
[metadata]
description=WebbedAuth
iconfile=icon.png
[ca]
C=GB
O=name
CN=name Attestation Root CA
[cert]
C=GB
O=name
CN=name Token Attestation
[fido2]
aaguid=insert-guid-here
devns=1.3.6.1.4.1.0.2
devid=1.3.6.1.4.1.0.1.1
[fidesmo]
title=Generic FIDO
description=Generic FIDO description.
issuerAccountId=0
executableLoadFile=A0000006472F00
searchBy=aid
executableModule=A0000006472F0001
application=A0000006472F0001
waitingMessage=Please wait while the attestation certificate is loaded.
successMessage=Installation successful.
failureMessage=Installation failure.
I stopped at this point because I was very curious about the devns and devid section. This lead me to sign up for a Private Enterprise Number under my org, webbedjoes. This has now been approved and I have my own number.
I would like to know how to approach this moving forward - and if there are any steps at this point that I should be considerate about before generating the private and public certificates required for FIDO2 to work.
Essentially at the end of it I would love to have my own FIDO2 certification approved by the FIDO Alliance so that it’s recognised as a legit authenticator however I do understand that this is a HUGE task and is probably impossible/not viable for a single person to do.
I’ve been trying to collect this info together myself but this is a whole can of worms that I’ve opened and now can’t stop!
My questions are:
- Is what I’m doing even realistically possible? Have I understood the process correctly? Should I just stop? (never!!!)
- If it isn’t possible, is there a FIDO2 applet with certification that I can use that’s trusted? (Doubt it as that wouldn’t be secure)
- Am I overthinking the entire thing? Should I just make the certificate with whatever details and hope for the best?
P.S I am trying hard to ensure I document my whole process, so when/if I can do this the information can be shared 
like it doesn’t exist at all. Works with my J3R180 so I know the webpage is working.