Certificates

Device Trust Manager issues x.509 certificates to devices to establish secure communication and authenticate with the platform. During provisioning, a device receives a bootstrap certificate, which verifies the device's identity and initiates secure communication with Device Trust Manager. As the device continues to operate, it may request operational certificates for short-term, specific operations as needed throughout its lifecycle.

Table 1. Issued certificate use cases

Use case
Bootstrap certificate	A bootstrap certificate is a long-lived x.509 certificate. Bootstrap certificates typically have a validity period covering the device's lifespan—for example, ten years. These "birth" certificates enable devices to securely communicate with Device Trust Manager. Bootstrap certificates are also used to request operational certificates and during device onboarding. Important Make sure to store the private key in a TPM, Secure Element, or Trusted Execution Environment to protect against unauthorized access and tampering.
Operational certificate	An operational certificate is a short-lived x.509 certificate. Devices request operational certificates using their bootstrap certificate. Operational certificates may be used for cloud services or other external systems, have shorter validity periods, and can be revoked or reissued as needed. Note Operational certificates are like temporary access badges for secure areas. They grant short-term permissions for a device to communicate with cloud services or external systems.

Use case

Bootstrap certificate

A bootstrap certificate is a long-lived x.509 certificate. Bootstrap certificates typically have a validity period covering the device's lifespan—for example, ten years. These "birth" certificates enable devices to securely communicate with Device Trust Manager. Bootstrap certificates are also used to request operational certificates and during device onboarding.

Important

Make sure to store the private key in a TPM, Secure Element, or Trusted Execution Environment to protect against unauthorized access and tampering.

Operational certificate

Certificate issuance and renewal

Device Trust Manager uses a range of protocols for certificate issuance and renewal, supporting both single and batch requests, as well as automatic renewals.

EST
SCEP
CMPv2
ACME
TrustEdge agent