Certificate Import

Import externally generated certificates into /IOTCONNECT™ to use your existing PKI infrastructure for device authentication. The platform supports importing CA certificates and device certificates in standard formats, enabling seamless integration with your current certificate management workflow.

Importing External Certificates

Organizations often have existing Public Key Infrastructure (PKI) systems that generate and manage certificates. /IOTCONNECT™ allows you to import these externally generated certificates rather than requiring you to create new ones within the platform.

Certificate import is useful in the following scenarios:

Existing PKI Integration: Your organization already operates a CA and issues device certificates through established processes.

Third-Party CA: Certificates issued by commercial CAs (DigiCert, GlobalSign, etc.) that you want to use for device authentication.

Migration: Moving devices from another IoT platform that already have certificates installed.

Manufacturing Pre-Provisioning: Devices arrive from the factory with certificates already burned into secure storage.

Supported Certificate Formats

/IOTCONNECT™ supports the following certificate file formats for import:

PEM Format (.pem): Base64-encoded certificate enclosed between “—–BEGIN CERTIFICATE—–” and “—–END CERTIFICATE—–” headers. This is the most common format for CA certificates and is the recommended format for import. PEM files are human-readable and can contain certificate chains (multiple certificates concatenated).

PFX / PKCS#12 Format (.pfx, .p12): Binary format that bundles the certificate and private key in a single password-protected file. Used when importing device certificates that include the private key. The password must be provided during import.

Format Conversion

If your certificates are in other formats, convert them before import:

DER to PEM: openssl x509 -inform DER -in cert.der -out cert.pem

CRT to PEM: Most .crt files are already PEM-encoded. Rename or verify with: openssl x509 -in cert.crt -text -noout

PEM to PFX: openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem

Importing CA Certificates

To import an external CA certificate into /IOTCONNECT™:

Step 1: Navigate to Security → Certificates in the portal.

Step 2: Click Import Certificate (or Create Certificate and select Import option).

Step 3: Enter a descriptive Certificate Name for identification.

Step 4: Select the certificate file (.pem format) from your local system.

Step 5: If importing a certificate chain, ensure the root CA is included in the PEM file (certificates ordered from leaf to root).

Step 6: Click Upload to import the certificate.

Step 7: Complete the Proof-of-Possession verification to activate the certificate.

Validation During Import

The platform validates the following during import:

Format Validity: The file must be a valid X.509 certificate in the supported format.

CA Flag: The certificate must have the CA:TRUE basic constraint (indicating it can sign other certificates).

Expiry Check: The certificate must not be already expired at the time of import.

Duplicate Check: The certificate thumbprint must not already exist in your account.

Importing Device Certificates

Device certificates are imported for individual enrollment scenarios where each device has a pre-existing certificate that needs to be registered with /IOTCONNECT™.

Individual Device Certificate Import

Step 1: Navigate to Security → Enrollment → Individual Enrollment.

Step 2: Click Add Individual Enrollment and select X.509 as the authentication type.

Step 3: Upload the device’s certificate file (.pem or .cer format — public certificate only, no private key).

Step 4: The platform extracts the Common Name (CN) as the device’s Registration ID.

Step 5: Configure the device template and optional settings.

Step 6: Save the enrollment. The device can now authenticate using this certificate.

Requirements for Device Certificates

Common Name (CN): Must be unique and will serve as the device identity in /IOTCONNECT™.

Key Usage: Certificate should have Digital Signature key usage for TLS client authentication.

No Private Key: Only upload the public certificate. The private key must remain securely on the device.

Valid Period: Certificate must be within its validity period.

Bulk Import Options

For large-scale deployments with many pre-provisioned devices, /IOTCONNECT™ provides bulk import capabilities:

CA-Based Group Enrollment: Instead of importing individual device certificates, import the signing CA certificate and create a group enrollment. All devices with certificates signed by that CA are automatically trusted — no per-device import needed.

CSV Bulk Registration: For individual enrollments at scale, prepare a CSV file with device Registration IDs and certificate thumbprints. Upload through the bulk import interface to register multiple devices simultaneously.

API-Based Import: Use the /IOTCONNECT™ REST API to programmatically register certificates and create enrollment entries. Integrate this into your manufacturing or provisioning pipeline for automated certificate registration.

Best Practices for Bulk Import

1. Validate certificate formats and expiry dates before bulk upload to avoid partial import failures.

2. Use group enrollment with CA certificates whenever possible — it scales better than individual certificate registration.

3. Maintain a secure offline backup of all imported certificates and their metadata.

4. Test the import process with a small batch before running a full bulk import.

ⓘ NOTE

Never upload private keys to the /IOTCONNECT™ portal when importing device certificates. Only the public certificate should be registered. Private keys must remain securely stored on the device hardware. If using PFX format for CA import, ensure the password is transmitted securely and the PFX file is deleted after import.