Proving which device is which.
WHAT IS REQUIRED
A unique identity per device Credentials that cannot be extracted or reused Mutual authentication with the platform
WHAT MUTUAL MEANS
The device also verifies the platform.
WHY THAT MATTERS
Otherwise a device connects to whatever claims to be the server.
WHAT CERTIFICATE-BASED IDENTITY PROVIDES
Proof without transmitting a reusable secret.
WHAT SECURE HARDWARE PROVIDES
Keys generated and used inside, never extractable.
WHY THAT IS THE STRONGEST OPTION
Physical extraction of the key becomes infeasible.
WHAT TO AVOID
Default credentials Credentials derived from serial numbers or addresses The same key across a production batch
WHY DERIVED CREDENTIALS FAIL
Once the derivation is known, every device is compromised.
WHAT CREDENTIAL ROTATION REQUIRES
The ability to issue new credentials remotely, and revoke old ones.
WHAT TO PLAN
Certificate expiry, which will occur during the device's life.
WHY THAT MATTERS ENORMOUSLY
Expired certificates disconnect a fleet permanently if renewal was not built in.
WHAT TO TEST
Renewal, before the first expiry.
WHAT TO MAINTAIN
A revocation list, honoured by the platform.
