Create an Azure IoT DPS cloud platform policy
Objectives
Onboard and register your device to Azure IoT Hub using Azure IoT Device Provisioning Service (DPS)
Securely authenticate your device using X.509 CA certificate-based attestation
Automatically provision and manage device certificates through DigiCert® Device Trust Manager’s cloud platform policy feature
Before you begin
You must have an active Azure subscription with permissions to create and manage Azure IoT Hub and Device Provisioning Service (DPS) resources
Access to Device Trust Manager with a user role that contains
Solution administratorpermission to manage cloud platform policies, certificate management policies, and device groups
Prepare Azure IoT Device Provisioning Service
Before you create an Azure IoT DPS cloud platform policy in Device Trust Manager, configure Azure IoT Hub, Azure IoT Device Provisioning Service (DPS), and an X.509 enrollment group in Azure.
Create an Azure IoT Hub that will receive devices provisioned through Azure IoT Device Provisioning Service (DPS).
For instructions, see Create an IoT hub on the Azure portal documentation.
Create an Azure IoT Device Provisioning Service (DPS) instance.
For instructions, see Create a new IoT Hub Device Provisioning Service instance on the Azure portal documentation.
Link your Azure IoT Hub to the Azure IoT Device Provisioning Service (DPS) instance that you'll use with Device Trust Manager.
For instructions, see Link the IoT hub and your Device Provisioning Service instance on the Azure portal documentation.
Identify the Issuing CA in Device Trust Manager that will issue operational certificates to your devices. You'll upload this CA certificate to Azure IoT DPS so that DPS can authenticate devices during provisioning.
To view all issuing CAs associated with your account, see View issuing CAs.
To download an Issuing CA certificate from DigiCert® Private CA, see Download an intermediate CA certificate.
重要
Download the issuing CA certificate in .pem format.
To enable X.509 certificate-based authentication, upload the issuing CA certificate that Device Trust Manageruses to issue operational certificates to devices.
To upload the issuing CA certificate:
In Azure DPS, go to Settings > Certificates.
Select Add.
Upload the issuing CA, which you have download in the
.pemformat.Provide a name for the certificate.
Choose Set certificate status to verified on upload.
Select Save.
Create an enrollment group that uses X.509 CA-based attestation to authenticate devices provisioned through Device Trust Manager. This enrollment group establishes the trust relationship between DPS and the Issuing CA, enabling DPS to validate device certificates during the provisioning process.
重要
The enrollment group must use the same issuing CA certificate that Device Trust Manager uses to issue operational certificates. During device provisioning, Azure DPS validates the device certificate chain against the issuing CA configured in the enrollment group.
For instructions, see Create an enrollment group on the Azure portal documentation.
Before you create an Azure IoT DPS cloud platform policy in Device Trust Manager, collect the Azure DPS configuration values required by the cloud platform policy wizard.
Use the following table to locate the required values in Azure:
Device Trust Manager field | Azure location |
|---|---|
DPS instance name | DPS > Overview Example: |
Provisioning service name | DPS > Overview > Name |
ID scope | DPS > Overview > ID Scope Example: |
Shared access key | DPS > Settings > Shared access policies > [Policy Name] > Primary Key |
Shared access key name | DPS > Settings > Shared access policies > provisioningserviceowner |
Prepare Device Trust Manager
Before you provision devices with Azure IoT DPS, complete the following configuration tasks in Device Trust Manager:
Create a division to organize devices and certificate management policies.
Create a bootstrap certificate management policy for initial device identity provisioning.
Create an operational certificate management policy that issues certificates for Azure DPS and Azure IoT Hub authentication.
重要
The operational certificate management policy you create must use the same Issuing CA certificate that you uploaded to Azure DPS.
Create a device group and assign the following certificate management policies:
Bootstrap certificate management policy
Operational certificate management policy
For instructions on assigning certificate management policies to your device group, see Assign certificate management policies to a device group.
Create an Azure IoT DPS cloud platform policy
After you have completed the Azure IoT DPS and Device Trust Manager prerequisites, create the cloud platform policy.
In the Device Trust Manager menu, go to Cloud platform policies.
Select Create a cloud platform policy.
Choose Azure IoT Device Provisioning Service.
Provide a name for the cloud platform policy.
On the Connect DPS section, provide the Azure DPS connection information you collected from your Azure environment.
If you haven't already gathered the required Azure DPS values, see Collect Azure DPS configuration details.
Provide the required information for the following fields:
DPS instance name: The fully qualified Azure DPS instance name
Provisioning service name: The name of the Azure Device Provisioning Service instance
ID scope: The DPS ID Scope value from the Azure DPS overview page
Shared access key: The primary key from the Azure DPS shared access policy
Shared access key name: The shared access policy name associated with the shared access key
Select Test connection after you provide all the required details.
This verifies if the configuration parameters provided by you are correct to connect to DPS.
Select Next to configure the enrollment group details
On the Enrollment Group section, provide the enrollment group information from Azure DPS. This information determines how devices are authenticated and provisioned through Azure DPS.
Provide the required information for the following fields:
Enrollment group name: The name of the Azure DPS enrollment group
Attestation mechanism: The enrollment group's authentication method. Device Trust Manager supports X.509 CA-based attestation
Issuing CA: The issuing CA certificate used by the enrollment group for device authentication. This must match the issuing CA used by the operational certificate management policy
You can also download the issuing CA in a
.pemformat upload it to Azure IoT DPS. See Step 6 under Prepare Azure IoT Device Provisioning Service.
Select Next to configure the IoT Hub details.
On the IoT Hub section, provide the Azure IoT Hub and device provisioning settings that Device Trust Manager uses when provisioning devices through Azure DPS.
Provide the required information for the following fields:
IoT hub settings:
IoT Hub Host Name: Enter the host name of the Azure IoT Hub that your devices will connect to
Select the IoT hubs this group can be assigned to (optional): Optionally, provide one or more IoT hubs that devices in the enrollment group can be assigned to during provisioning
Select how you want device data to be handled on re-provisioning: Specify how Azure DPS should handle existing device data when a device is re-provisioned.
Select how you want to assign devices to hubs: Choose the device allocation policy that Azure DPS uses when assigning devices to available IoT hubs
Device settings:
Enable IoT Edge device capabilities: When enabled, the devices in this enrollment group will be provisioned as IoT Edge devices
Registration Query Retry Interval (seconds): Specify how long Device Trust Manager should wait between registration status queries
You can provide values between
0to10.Registration Query Retry Count: Specify the maximum number of registration status queries before the operation times out
You can provide values between
0to5.Initial Device Twin State (optional): Optionally, provide the initial Azure IoT Hub device twin configuration to apply when a device is provisioned
Select Next to continue to the cloud platform policy assignment and review steps.
On the Configure device group policy section, assign the cloud platform policy to the appropriate division and device groups.
Under Assign policy to division (optional), select a Divison if you want to limit the cloud platform policy to devices and device groups within a specific division.
Under Device group, select the device group that contains the devices you want to provision
Under Operational Certificate management policy, select the certificate management policy that issues the operational certificates used for Azure DPS authentication.
重要
Select the operational certificate management policy that uses the same issuing CA certificate configured in the Azure DPS enrollment group. This ensures that Azure DPS can trust and authenticate certificates issued to devices.
Under Add assignment (optional), repeat the above steps to add additional device group assignments as needed.
Select Create a cloud platform policy.