Certificate Provisioning

Operational provisioning commands live in Device Provisioning. This page covers the security model and credential practices.

TLS and authentication model

• Device authentication uses X.509 X.509
  X.509 certificate standard — device identity format used for AWS IoT Core mutual authentication. certificates
• MQTT MQTT
  Message Queuing Telemetry Transport — lightweight publish/subscribe protocol used between ESP32 and AWS IoT Core. transport uses TLS 1.2 mutual authentication mutual authentication
  Mutual TLS — both client and server present certificates. ESP32 uses mTLS with AWS IoT Core over TLS 1.2. against AWS IoT Core AWS IoT Core
  AWS IoT Core — managed MQTT broker with X.509 device authentication for ESP32 telemetry and events.
• Firmware MQTT connections use WiFiClientSecure with QoS 1 QoS 1
  Quality of Service — firmware publishes with MQTT QoS 1 (at least once delivery). publishing

PEM files and their purpose

• Device certificate PEM: identifies the specific device identity to AWS IoT Core AWS IoT Core
  AWS IoT Core — managed MQTT broker with X.509 device authentication for ESP32 telemetry and events.
• Private key PEM: proves possession of that certificate identity
• Root CA PEM: validates the AWS IoT endpoint certificate chain

After certificate creation, activation and registration steps make the certificate usable for MQTT connections.

Credential management practices

• Keep PEM artifacts ignored by git
• Generate certs per device instead of sharing one keypair
• Restrict file permissions to owner-read-only where practical

chmod 400 firmware/certs/*.pem

• Prefer storing long-lived credential material outside the repository working tree