Public key infrastructure

The certificates and keys behind NervesHub's certificate-based device auth: device certificates, Signer CAs, and the chain of trust.

Written By Josh Kalderimis

Last updated About 2 months ago

Certificate-based device authentication rests on a small public key infrastructure (PKI) that you control. This page explains the pieces and how they establish trust. For the authentication flow itself, see Device authentication & mTLS.

The pieces

Piece

What it is

Device certificate

An X.509 certificate identifying one device. Its common name is the device ID.

Device private key

The secret half of the device's key pair. It never leaves the device.

Signer certificate (CA)

A self-signed CA you create. It signs device certificates.

Signer private key

The secret that lets you sign device certificates. Guard it.

Not a public CA

The Signer certificate is a Certificate Authority, but not one from the public web PKI (Let's Encrypt, DigiCert, and so on). It's a self-signed certificate you generate and register to your NervesHub organization. NervesHub trusts devices whose certificates chain up to a Signer CA you've registered, and nothing else.

The chain of trust

  1. You create a Signer CA and keep its private key secret.

  2. Each device gets a device certificate signed by that Signer CA, plus a private key that stays on the device (ideally in secure hardware).

  3. You register the Signer CA with your organization so NervesHub can recognize it.

  4. When a device connects over mutual TLS, it proves it holds the device private key, and NervesHub checks that a registered Signer CA signed the certificate.

Think of it as a split password: NervesHub holds the public side and trusts the Signer CA; the device proves it holds the private side.

Fingerprints and rotation

NervesHub records a fingerprint of each device certificate and of its public key. This lets it recognize a device instantly on reconnect, detect when two devices try to share a public key (not allowed), and handle certificate rotation: a device can present a new certificate for the same public key, and NervesHub records it as a rotation rather than a new device.

Protecting the keys

Two secrets matter most:

  • The Signer private key creates devices NervesHub will trust. If it leaks, an attacker could mint trusted devices, which is worse under JITP.

  • The device private key is the device's identity. Storing it in secure hardware means even full filesystem access can't extract it.

Related