PKI

The PKI section explains how to build and operate X.509 trust in Lamassu: which authorities issue, which rules apply and how to check certificates. It is intended for PKI administrators and anyone who needs to use certificates in a consuming system.

Start here

Follow PKI getting started to create a CA, issue a client certificate and verify it with OpenSSL. The result is a certificate, its private key and a verified chain.

You can complete that path before managing devices. When you need to associate the identity with an inventory or automate its enrollment, continue in IoT Fleets.

What you need

• An accessible instance and permission to manage the keys, CAs and certificates you will use.
• An available cryptographic engine to keep the authority's key.
• The certificate's purpose, such as authenticating a client through mTLS.
• Consumer requirements: accepted issuers, algorithms, names and permitted usages.

Prepare the instance and cryptographic provider in Deployment. The trust model explains hierarchy choices.

Core capabilities

Build your trust hierarchy

Authorities sign certificates. A root establishes the trust anchor, and an intermediate separates issuance by environment or purpose. Hierarchy and rotation explains how to maintain trust when replacing an authority.

Protect cryptographic keys

CA signing keys are managed through KMS and cryptographic engines. A client that generates a CSR can keep its own key: preserve that custody when choosing the issuance method.

Issue and control certificates

A profile establishes subject, validity, usage and key restrictions. The CA applies issuance configuration and signs the certificate. In the inventory, you can inspect the result, download it and manage its status.

Publish validation status

Validation covers the chain, validity, usages and revocation status. Lamassu publishes status through OCSP and CRL; the consumer configures which issuers it recognizes and how it checks that status.

How to check the result

An active certificate in the console is one part of the check. Also verify that:

• its subject and extensions identify the expected client;
• its public key matches the client's private key;
• its chain reaches a root trusted by the consumer;
• its dates and usages allow the operation;
• the consumer applies revocation checks and authorization.

The issuance path includes the first independent checks.

Continue