I'm currently in the process of designing the security model for an IoT product my company is developing.
The device will be connected to the internet via WiFi and shall communicate with our company's server only.
- The communication will be done via HTTPS
- During physical product assembly, the server's SSL fingerprint will be stored on the device. The device uses this fingerprint to make sure that it actually talks to its "home" server everytime it establishes a connection
A problem with this approach arises as soon as the server's SSL certificate changes. All devices in the field will then no longer be able to connect to the server due to a failing fingerprint check.
A partial solution would be to create a time period in which the server would distribute its new fingerprint to all connected devices, along with the exact time it becomes valid. The devices could store the new key and use it starting from the advertised date. But this doesn't solve the problem for devices which are not online during the fingerprint distribution period.
Is there any potential solution to this problem which I might have overlooked? What is "the right way" to do such a thing? (I can't be the first one to do it, can I?)