Lamassu IoT DocsCertificates
Inspect, download and revoke the certificates issued by Lamassu.
This guide is for a PKI operator inspecting or retiring an issued identity. You need inventory access and, to change states, permissions on the certificate. Open Certificates for a global view or Issued Certificates within a CA to restrict it to that issuer.
Find a certificate
Filter by Common Name, serial, status and issuer. Use Quick Inspect for a quick review or View Details for subject, SAN, usages, chain, dates and metadata.
Identify a certificate by issuer and serial; a name can correspond to several renewals. Check which certificate the consumer actually uses and which occupies the device’s active identity. Identity history and the certificate inventory answer different questions.
Download the certificate
Download the PEM and inspect it:
openssl x509 -in device.crt -noout -subject -issuer -serial -dates
openssl x509 -in device.crt -noout -textCheck issuance policy, chain and usages with the verification walkthrough. A certificate does not contain its private key. For an external CSR, the key remains where it was generated; for the browser flow, retain the file downloaded upon issuance. If the key is lost, plan a new identity rather than expecting recovery from the certificate.
Issue from an existing CSR
Use this flow when the identity’s key must remain on the system that generated it. You need an active CA with a usable key, a PEM CSR and a suitable profile.
- Verify the request with
openssl req -in request.csr -noout -verify -text. Review subject, SAN and algorithm, and authorize the requested identity. - Start issuance from the CA or inventory and select Upload Existing CSR.
- Confirm the CA and profile resolved according to Profiles; the request does not guarantee that every field is retained.
- Download the certificate and inspect dates, issuer, subject, SAN, KU and EKU. Check correspondence with the private key on the originating system.
- Install certificate and chain in the intended consumer and test a connection. Issuance alone does not register a device or grant access in an integration.
For browser key generation, follow Issue your first certificate.
Revoke a certificate
Revoke when the key is compromised, the subject is no longer authorized or the identity must stop being accepted before expiration. Before changing status, identify consumers and prepare any required replacement.
Open the action
Locate the correct issuer and serial and select Revoke Certificate. EXPIRED records and records revoked for a final reason reject subsequent status changes.
Choose a reason
Select the incident reason. CertificateHold represents a reversible certificate suspension; other reasons block later changes. Do not use a suspension to address a compromised key.
Confirm and verify
Save the change and read the record again: require REVOKED, reason and timestamp. Then verify a fresh OCSP query and, if using CRL, its published version and the serial’s presence. Finally check rejection of a new connection in the consumer.
Revocation does not erase the certificate, delete the key or guarantee closure of existing sessions. Status and publication are separate steps.
Only CertificateHold is reversible
A certificate revoked with CertificateHold can be reactivated if it is not in EXPIRED state. Its dates and consumer trust remain mandatory.
Reactivate a hold
Check that the saved reason is CertificateHold and the identity still satisfies policy. Request ACTIVE through the status update operation exposed by your installation; consult the API reference. Do not assume changing consumer permissions also changes status in Lamassu.
Read the record and query OCSP again. With regenerate_on_revoke enabled, the reactivation event requests CRL regeneration: check that the new list omits the serial. An earlier list can still mark it revoked until the client refreshes its copy.
This does not undo permanent revocation or a cascade started by revoking a CA.