Lamassu IoT DocsLamassu IoT Platform
Build a PKI and apply its certificates to your devices' lifecycle.
Lamassu IoT lets you administer a private PKI and use it to issue, renew and revoke X.509 device identities. The Platform documentation follows two paths: PKI, for authorities and certificates, and IoT Fleets, for applying those identities to a device population.
Start here
Choose the result you need:
Issue and verify a certificate
Prepare a CA, issue an X.509 identity and check its chain and key.
Enroll and connect a device
Prepare the DMS, request an identity through EST and check an mTLS connection.
If you are still preparing the instance, start in Deployment. The Platform paths assume an accessible console and permission to perform the operations.
Choose your path
| Section | What you manage | Entry point |
|---|---|---|
| PKI | Keys, authorities, profiles, certificates and publication of revocation status. | PKI overview |
| IoT Fleets | Devices, identity history, DMS policies, EST enrollment and integrations. | IoT Fleets overview |
| Administration | Operator permissions, audit and event subscriptions. | Access control |
A CA determines who signs, and a profile defines what can be issued. The DMS applies admission and enrollment policy. The device retains its association with certificates, and the external consumer decides which identity it accepts.
Architecture at a glance
An identity's journey connects four responsibilities:
- The PKI administrator prepares the authority, its key and issuance rules.
- The provisioning administrator configures the DMS and initial trust.
- The device client requests a certificate and installs it with the matching key.
- The consumer validates the identity and applies its access permissions.
See How Lamassu works to understand the resources and platform architecture for the services. Installation, network exposure and dependencies are explained in Deployment.
Core capabilities
Build your trust hierarchy
Create or incorporate authorities and organize their relationships in PKI. The hierarchy and its rotation determine which chains consumers must recognize.
Protect cryptographic keys
Choose the engine that keeps authority keys and control who can use them. See Keys and engines; provider setup belongs to deployment.
Issue and control certificates
Define issuance profiles, sign requests and review the certificate inventory. Check the issued certificate from the client that will use it.
Automate device identities
Configure a DMS and use EST to request and renew certificates. Preparing the initial credential and installing the result belong to device integration.
Publish validation status
Use OCSP and CRL to publish revocation status. Each consumer must configure how it retrieves and applies that information.
React to events
Use audit logs to investigate changes and configure alerts and subscriptions to react to lifecycle events.
Operational reference
| Responsibility | What it prepares or checks |
|---|---|
| PKI administrator | Key custody, CA hierarchy, profiles and validation. |
| Fleet administrator | DMS, device admission, renewal policy and inventory. |
| Device integrator | Initial credential, server trust, EST client, and key and certificate storage. |
| Consumer integrator | Issuer trust, certificate validation and permissions in the destination. |
| Infrastructure operator | Installation, network, availability, dependencies and deployment diagnosis. |
The API reference contains contracts for automating operations. To investigate a failure, start in the affected section: PKI, EST or Deployment.