Here is how engineers and product vendors can prototype and try EJBCA PKI for their Matter IoT devices today

Here is how engineers and product vendors can prototype and try EJBCA PKI for their Matter IoT devices today

Are you an engineer developing a product for the new Matter IoT standard? Today, product vendors can prototype and try EJBCA PKI for their Matter IoT devices. Matter is an open-source connectivity standard for smart home and Internet of Things devices that aims to improve compatibility and security.

Security is an essential aspect of the Matter standard, which includes a Public Key Infrastructure (PKI) for issuing device certificates. Every device must have a unique and verifiable identity, and software updates should be cryptographically signed using PKI certificates to enable secure over-the-air (OTA) updates. Therefore, understanding and correctly implementing PKI for your IoT devices is crucial for several reasons:

1. Secure Device Communication: Certificates play a vital role in establishing secure communication channels between IoT devices. By utilizing a PKI, you can issue certificates that enable encryption, authentication, and secure data transfer, safeguarding your devices and data from unauthorized access and tampering.
2. Compliance with Matter Specification: By setting up a PKI that issues Matter-compliant certificates, you ensure that your devices adhere to the required standards, interoperability, and security protocols.
3. Trust and Device Identity: The Matter PKI Certificate Policy defines specific requirements and guidelines for issuing certificates within the Matter ecosystem. Adhering to this policy ensures that your certificates meet the necessary criteria and can be trusted by other participants in the ecosystem.

Our guides and tutorial videos let you start testing today

To help you get started, we offer guides and tutorial videos for testing today. As a product vendor, you may consider retaining full control and ownership of your PKI to sustain flexibility and easily scale with growing demand and product portfolio. With EJBCA, you get that and can start testing and prototyping today. Please note that to create a production PKI compliant with the Matter Certificate Policy, other aspects, such as using a Hardware Security Module for the PAA and PAI signing keys, are required.

Steps to follow when configuring EJBCA for Matter IoT

A Matter PKI typically implement three levels of trust:

• Root CA - PAA (Product Attestation Authority)
•  Sub CA - PAI (Product Attestation Intermediate)
• End Entity - DAC (Device Attestation Certificate)

Here's an overview of the steps you need to follow to configure EJBCA PKI for issuing certificates to Matter IoT devices at these levels:
Step 1 - Creating the PAA:

1. Setting up the PAA as a Root CA using Docker and EJBCA.
2. Configuring PAA settings, generating keys, and defining certificate profiles.
3. Creating the PAA certificate and downloading it.

Step 2 - Creating the PAI:

1. Starting a separate EJBCA container for the PAI.
2. Importing the PAA certificate to the PAI.
3. Configuring PAI settings, generating keys, and creating the PAI certificate.
4. Signing the PAI Sub CA certificate with the PAA.
5. Creating certificate profiles and end entity profiles for DACs on the PAI.

Step 3 - Creating the DAC:

1. Emulating a device and generating a key pair and CSR using OpenSSL.
2. Uploading the DAC CSR to the PAI RA Web and issuing the DAC certificate.
3. Verifying the DAC certificate and viewing its details.

If you want to try it yourself, follow our step-by-step guide to configure your PKI and start issuing Matter-compliant certificates for your devices

Here is the link to our YouTube Tutorial video:

How-to guide in our documentation

There's also a guide on keyfactor.com, where we go into more detail about Matter IoT and how Keyfactor products can deliver identity issuance, governance, and operational efficiency at scale.

To conclude

By setting up a PKI to issue Matter-compliant certificates, vendors can ensure their IoT devices adhere to industry standards, communicate securely, and establish trust within the Matter IoT ecosystem. As an engineer, you can use our how-to guide and a tutorial video to start testing today and configuring EJBCA PKI for issuing certificates at various levels within the hierarchy. Remember to keep up with the latest Matter specifications and policies to maintain compliance and stay up to date.