IoT Device Identity and Certificate Management at Fleet Scale

IoT certificate management is the end-to-end process of issuing, renewing, revoking, and auditing X.509 certificates on connected devices. Each device gets a unique certificate that, combined with a private key that never leaves the hardware, proves its identity via mutual TLS (mTLS). A complete platform covers five stages: (1) issuance at provisioning, (2) automated renewal before expiration, (3) on-demand rotation after a security event, (4) per-device revocation without fleet-wide impact, and (5) audit logging of every certificate event.

Provisioning: A script calls the CA to issue a unique X.509 certificate. The private key is generated on-device and never transmitted. Registration: The device registers with the management platform using its certificate as its identity. Renewal: A renewal agent monitors validity. When below a threshold (typically 30 days), it requests a new certificate automatically. Rotation: After a compromise, the CA issues a new certificate and revokes the old one immediately — only that device is affected. Revocation: Decommissioned devices are revoked at the CA, preventing future connections. With SocketXP, all five stages are automated through the built-in PKI CA and OTA script execution.

Evaluate on five criteria: (1) a built-in CA so no separate PKI is needed, (2) automated OTA renewal so certificates never expire silently, (3) per-device revocation without fleet-wide impact, (4) zero-touch provisioning so every device gets a unique certificate at first boot, and (5) compliance coverage — IEC 62443, NIST SP 800-213, HIPAA, NERC CIP, or EU CRA. SocketXP provides all five in a single platform, with out-of-box mutual TLS that satisfies IEC 62443 Security Level 2 and EU CRA requirements.

AWS IoT Core requires certificates to be pre-provisioned or registered before devices can connect, and enables fleet provisioning through Lambda functions, provisioning templates, and IAM policies. SocketXP's built-in PKI CA issues certificates on demand via a single command on the device — zero-touch provisioning requires only a first-boot shell script. AWS IoT Core is purpose-built for the AWS ecosystem; SocketXP is infrastructure-agnostic and runs on any Linux device, any cloud, on-premises, or air-gapped.

For the SocketXP management channel, no separate PKI is needed — the built-in PKI CA handles certificate issuance automatically. For application-layer mTLS (MQTT, HTTPS APIs, databases), any X.509-compliant CA works. The BYOCA option on the self-hosted gateway lets you plug in an existing CA directly — HashiCorp Vault PKI, Microsoft ADCS, or any internal CA.

The mutual TLS handshake fails and the device cannot establish a management tunnel until the certificate is renewed. This is why automated renewal — triggered before the expiration threshold — is essential for production fleets. See the IoT certificate rotation guide for the complete renewal pipeline.

Use SocketXP's OTA remote script execution to push a renewal script to the entire fleet or a targeted device group. The script renews only certificates within the threshold; devices outside it exit early. For zero-downtime rotation, roll out in batches rather than all devices simultaneously.

Standard TLS authenticates the server to the device but not the device to the server. Mutual TLS (mTLS) authenticates both sides — the device verifies the gateway certificate and the gateway verifies the device certificate — before any traffic flows. With mTLS enabled, unauthenticated clients and decommissioned devices are rejected at the handshake.

Yes. SocketXP's self-hosted gateway supports BYOCA — configure it to validate client certificates against your own CA chain instead of SocketXP's built-in PKI CA. Any X.509-compliant CA is supported — HashiCorp Vault PKI, Microsoft ADCS, or an internal CA.

Device server certificates have a configurable validity period — set to match your renewal cadence and security policy. Shorter validity reduces exposure if a certificate is compromised. User client certificates are fixed at 24 hours and expire automatically at session end. For configuration details, see the SocketXP mTLS documentation.

An API token is a string — extractable from firmware, copyable to any machine, usable from anywhere until explicitly revoked. An mTLS certificate requires the matching private key, which never leaves the device. On devices with TPM or Secure Element hardware, the key cannot be exported at all. mTLS also provides per-device identity — every management action is tied to a cryptographically verified device, not a shared credential.

Yes. The EU CRA (Regulation 2024/2847) requires connected products sold in the EU to implement unique device identity, encrypted communications, and OTA security update capability — with full compliance required by December 2027. SocketXP addresses all three: every device gets a unique X.509 certificate, all management traffic is mutually authenticated and encrypted, and OTA enables security patches without physical access. For a detailed EU CRA compliance mapping, contact SocketXP's enterprise security team.

SocketXP's mutual TLS satisfies the mutual authentication and certificate-based identity requirements of IEC 62443 Security Level 2, the device identification and cryptographic capability requirements of NIST SP 800-213, and the encrypted management channel requirements of NERC CIP CPS. All management traffic flows through encrypted mTLS tunnels. Contact SocketXP's enterprise security team for detailed compliance documentation.

A first-boot script registers the device with SocketXP, then requests a unique certificate from the built-in PKI CA using the device hostname or serial number as identity. Every device cloned from the same image generates its own certificate independently — no manual per-device issuance required. See the zero-touch provisioning guide for the full workflow.

An IoT PKI (Public Key Infrastructure) is the hardware, software, policies, and procedures for creating, managing, and revoking digital certificates on IoT devices. It includes a root CA as the trust anchor, intermediate CAs for device certificate issuance, a revocation mechanism (CRL or OCSP), and an audit log. SocketXP's built-in PKI CA provides a complete cloud-hosted IoT PKI with no separate infrastructure to deploy.

IEC 62443 Security Level 2 — the baseline for most industrial IoT deployments — requires: (1) mutual authentication using cryptographic credentials, (2) unique device identity for per-device audit and revocation, (3) private keys that cannot be extracted or shared, and (4) certificate-based authentication rather than passwords. SocketXP's mutual TLS satisfies all four requirements.

ACME works well for web servers that can prove domain ownership via HTTP or DNS challenges. IoT devices behind NAT or firewalls cannot serve HTTP challenges, and domain-based validation does not map to hardware device identity. SocketXP's built-in PKI CA issues certificates based on device identity tokens instead — no public IP, no HTTP challenge, no DNS setup required.