How does an IOT device connect with AWS IOT using a provisioning claim certificate during device provisioning?

1
votes

I am planning to connect my IOT device (ESP32) to AWS IOT Core through a Flutter app by automatically creating the required IOT Thing and generating the required certificates and Key pairs.

The device and app are isolated (except during a configuration process) and I don't prefer any hardcoding of IOT Thing 'name'. I am following the documentation of AWS IOT (Provisioning devices that don't have device certificates using fleet provisioning). Till now, I have created a Fleet Provisioning Template on AWS (that will create a unique IOT Thing after provisioning), attached policies in it and also attached a Provisioning claim certificate. This provisioning claim certificate and attached private keys have been hardcoded in my ESP32 code (using Arduino IDE).

The further part of documentation states that "The device should use the AWS IoT Device and Mobile SDKs to connect to and authenticate with AWS IoT using the provisioning claim certificate that is installed on the device".

My Question is - Since I am using Arduino IDE for my ESP32 code, what exactly should I include in my code for device provisioning part. Also, how and where does the device connect using provisioning claim certificate and how exactly will the device get new certificates and Keys for future connections (Device provisioning using MQTT API can be one of the solution but how should it be used in Arduino IDE?)

1
amazon-web-servicesesp32provisioningaws-iot

1 Answers

0
votes

I guess you are generating RSA key pair on device itself? Who do you want to sign the device certificate - AWS IoT Core or your own KMS provider?

If for the above questions, the answer is "Yes" then,

  1. You may need to register your CA certificate (who is signing your device certificate) on AWS IoT Core
  2. Configure JITP template on AWS IoT Core against the CA certificate.

The template you can configure such a way that the JITP process reads device certificate's Subject CN (assuming CN will be your device name) and map the CN to thing name. Also, it will assign the required policy.

This all will happen first time when you connect your device using MQTT protocol providing device certificate (along with certificate chain).

Here is reference link for JITP.