Certificates – iotconnect

Certificates Management

The /IOTCONNECT™ portal provides comprehensive certificate management capabilities for your IoT deployment. Manage CA certificates, track their status and expiration, verify ownership, and maintain a secure certificate infrastructure — all from a centralized interface.

Managing CA Certificates in the Portal

The Certificates section in /IOTCONNECT™ allows you to register, verify, and manage Certificate Authority (CA) certificates. These CA certificates form the trust anchor for device authentication — any device presenting a certificate signed by a registered and verified CA will be trusted by the platform.

To access certificate management, navigate to Security → Certificates in the /IOTCONNECT™ portal. You will see the certificate list displaying all registered CA certificates for your account.

Certificate Lifecycle

Created: Certificate is uploaded but not yet verified. Devices cannot authenticate against unverified certificates.

Verified: Proof-of-possession completed successfully. The certificate is active and devices can authenticate using it.

Expiring Soon: Certificate is approaching its expiry date. Plan for rotation to avoid service interruption.

Expired: Certificate has passed its validity period. Devices using this CA can no longer authenticate until a new certificate is registered.

Certificate List

The certificate list provides an overview of all registered CA certificates. Each entry displays the following columns:

Certificate Name: The user-defined name assigned when the certificate was created. Use descriptive names like “Production-RootCA” or “Staging-IntermediateCA” for easy identification.

Origin: Indicates how the certificate was added — either “Created” (generated through the portal) or “Imported” (uploaded from an external source).

Reference ID: A unique system-generated identifier for the certificate. Used when referencing the certificate in enrollment groups and API calls.

Status: The current state of the certificate — Pending Verification, Verified, Expiring Soon, or Expired.

Expiry Date: The date and time when the certificate expires. Monitor this to plan certificate rotations before expiry.

The list supports sorting by any column and provides quick-action buttons for each certificate entry.

Creating Certificates

To register a new CA certificate in /IOTCONNECT™:

Step 1: Click the Create Certificate button in the top-right of the certificates page.

Step 2: Enter a Certificate Name that clearly identifies the purpose (e.g., “Factory-Floor-CA-2024”).

Step 3: Upload the CA certificate file in PEM format (.pem extension).

Step 4: Click Save. The certificate is created with “Pending Verification” status.

Step 5: Complete the verification process (proof-of-possession) to activate the certificate.

After verification, devices presenting certificates signed by this CA can authenticate with /IOTCONNECT™.

Video Walkthrough: Certificate Creation

Watch the complete walkthrough video showing the end-to-end process of creating a certificate, configuring a JITP rule, and enabling secure device authentication with the IoTConnect platform.

Filtering and Searching Certificates

The certificate list supports filtering to quickly find specific certificates:

Search by Name: Type in the search box to filter certificates by name. Supports partial matching.

Filter by Status: Filter to show only Verified, Pending, or Expired certificates.

Filter by Origin: Show only Created or Imported certificates.

Sort by Expiry: Sort the list by expiry date to identify certificates needing rotation soon.

These filters help manage large certificate inventories and quickly identify certificates requiring attention.

Verifying Certificates

Certificate verification (proof-of-possession) proves that you control the private key of the uploaded CA certificate. This prevents unauthorized parties from registering certificates they don’t own.

Verification Process

1. Click the Verify action on a certificate with “Pending Verification” status.

2. The portal displays a unique Verification Code (a random string).

3. Using your CA private key and OpenSSL (or similar tool), create a verification certificate with the verification code as the Common Name (CN).

4. Upload the verification certificate to the portal.

5. The platform validates that the verification certificate was signed by the CA’s private key.

6. If valid, the certificate status changes to Verified.

The verification code expires after 24 hours. If not completed within this window, you must generate a new verification code.

Deleting Certificates

To remove a CA certificate from /IOTCONNECT™:

1. Locate the certificate in the certificate list.

2. Click the Delete action (trash icon) for the certificate.

3. Confirm the deletion in the confirmation dialog.

Important Considerations Before Deleting

Active Devices: Deleting a CA certificate will prevent all devices authenticated by that CA from reconnecting. Ensure no active devices depend on this certificate.

Enrollment Groups: Remove any enrollment groups referencing this certificate before deletion.

Irreversible Action: Certificate deletion cannot be undone. You will need to re-upload and re-verify the certificate if needed again.

ⓘ NOTE

Always verify your CA certificate before attempting device connections. Devices presenting certificates signed by an unverified CA will be rejected. Plan certificate rotations at least 30 days before expiry to avoid disruption to device connectivity.