Device Management Service

A Device Management Service (DMS) acts as the registration authority facing a fleet. It receives requests, applies the authentication policy and delegates issuance to the configured CA.

Each DMS is an independent operational boundary: it can represent a product line, an environment or a device type with its own CA, authentication rules, distributed trust and renewal window.

Before you begin

Create or import at least one active CA.
Decide how devices will authenticate during initial enrollment.
Define which authorities the device should receive as anchors of trust.
Make sure you have permissions to administer DMSs.

Configure a DMS

Identify the fleet

Give the DMS a name that describes its scope, for example a device family or an environment.

Select the enrollment CA

Choose the authority that will issue the identities. Its policy and validity period constrain the certificates the fleet can obtain.

Configure EST

Define the authentication of enroll, the reenroll policy, the renewal window and, if needed, serverkeygen.

Distribute trust

Configure CA Distribution to control the response of the cacerts endpoint.

Verify the endpoints

From the DMS menu, open EST (RFC-7030) and check the base URL and the invocation examples before integrating the firmware.

Trust distribution

Include Lamassu System CA distributes the TLS certificate of the Lamassu server, useful for pinning. It does not represent an issuing CA.
Include Enrollment CA adds the authority configured to issue the DMS's identities.
Managed CAs lets you include additional authorities the device must consider trusted.

Operate the DMS inventory

Edit modifies the DMS policy.
Go to DMS owned devices opens only the devices of that fleet.
Show/Edit Metadata manages advanced configuration and integration data.
EST (RFC-7030) shows the endpoints and examples specific to the DMS.
Delete removes the DMS and its configuration. The action is irreversible.