My company is a IoT-Gateway manufacturer. Customers are increasingly getting serious about security issues in the IoT domain. Additionally, governments require dedicated security features as HTTPS for embedded web severs.
For example, the German government agency for security in IT-systems (BSI) requires to use "TLS 1.2 in combination MIT Perfect Forward Secrecy" as minimum security.
My questions are:
- From an IoT manufacturer's point of view, is an "upload certificate" feature in the IoT device sufficient to ensure certificate security?
- Are there already a standard API (or RFC) to replace certificates? Considering large IoT installations the replacement and management of certificates is defitively a big challenge.
- How do companies manage the HTTPS certificate infrastructure for IoT devices today? Are self-signed certificates used in Intranets or official certificates? Does every IoT gateway get a different certificate? Do companies operate private certificate authorities?