Use EJBCA PKI instead of OpenSSL and self-signed certificates while developing your IoT solution to ensure long-term scalability and security.
Challenge
To ensure cybersecurity in IoT solutions, edge devices, gateways, and servers must be capable of establishing mutual trust as well as trust in the firmware and software they execute.
This can only be achieved by equipping each system with at least a unique and secure digital identity. It must be small enough to be hosted inside a limited memory, strong enough to comply with the latest cybersecurity standards, and easy to check so that even small devices can verify who they are talking to and whether their firmware is genuine.
It must also be capable of supporting the derivation of robust session keys without exposing any secrets over any channel, and flexible enough so that every company can draw their own private circle of trust and decide who can enter or intersect with it. The technology does exist: it is called “private-public key infrastructure” and the digital identities are “digital certificates” following the X.509 standard.
As a developer of connected devices and machines or a cybersecurity expert supervising their deployment and operational security, implementing such technology is essential to safeguard against potential cyber threats. Modern industry standards and recommendations call for PKI and X.509 certificates to secure and authenticate communication, software, and supply chains for IoT. Examples of such standards and recommendations are:
Solution
While free certificate issuance tools and self-signed certificates may be convenient for software development test purposes, they are not recommended for deployment. Unlike a PKI, self-signed certificates cannot draw the private circles of trust expected by all the standards. EJBCA is scalable, enterprise-grade, and easy to deploy, also for testing and prototyping as well as production purposes.
Using our best practices how-to and videos, you can set up a PKI to issue certificates for your industrial infrastructure and IoT devices. Once you're up, you can start tailoring your PKI and you'll have a fully functional PKI, including Certificate Authorities, roles, certificate profiles, a configured use case/issuing protocol, revocation support, and system documentation.
Get started with video tutorials and how-tos:
Stay up to date with the latest news and blog articles, and find out about upcoming events related to EJBCA.
Bouncy Castle is one of the most widely used FIPS-certified open-source cryptographic APIs for Java and C#, allowing developers to integrate PKI security into their applications easily.
