Certificates

Device Trust Manager issues x.509 certificates to devices to establish secure communication and authenticate with the platform. During provisioning, a device receives a bootstrap certificate, which verifies the device's identity and initiates secure communication with Device Trust Manager. As the device continues to operate, it may request operational certificates for short-term, specific operations as needed throughout its lifecycle.

Tabella 1. Issued certificate use cases

Use case	Description
Bootstrap certificate	A bootstrap certificate is a long-lived x.509 certificate. Bootstrap certificates typically have a validity period covering the device's lifespan—for example, ten years. These "birth" certificates enable devices to securely communicate with Device Trust Manager. Bootstrap certificates are also used to request operational certificates and during device onboarding. Importante Make sure to store the private key in a TPM, Secure Element, or Trusted Execution Environment to protect against unauthorized access and tampering.
Operational certificate	An operational certificate is a short-lived x.509 certificate. Devices request operational certificates using their bootstrap certificate. Operational certificates may be used for cloud services or other external systems, have shorter validity periods, and can be revoked or reissued as needed. Avviso Operational certificates are like temporary access badges for secure areas. They grant short-term permissions for a device to communicate with cloud services or external systems.

Use case

Description

Bootstrap certificate

A bootstrap certificate is a long-lived x.509 certificate. Bootstrap certificates typically have a validity period covering the device's lifespan—for example, ten years. These "birth" certificates enable devices to securely communicate with Device Trust Manager. Bootstrap certificates are also used to request operational certificates and during device onboarding.

Importante

Make sure to store the private key in a TPM, Secure Element, or Trusted Execution Environment to protect against unauthorized access and tampering.

Operational certificate

Certificate issuance and renewal

Device Trust Manager uses a range of protocols for certificate issuance and renewal, supporting both single and batch requests, as well as automatic renewals.

EST
SCEP
CMPv2
ACME
TrustEdge agent

What's next?

Ready to issue certificates? Request certificates for managed devices or unmanaged devices.

In questa sezione: