I have read that PKI certificates are the main way to provide security on IoT platforms. And the common enrollment protocols for certificates are:

(CMP is the one which is used for securing LTE eNodeBs.)

Now what is not clear is what devices get the certificates? I am assuming that sensors etc are too small to get certificates and use them? So is anything used for securing sensors in IoT? I think gateways can use certs but gateways probably don't need these protocols - they are not really IOT devices. Also what do the gateways use the certs for - is it to communicate with the cloud servers or is it to communicate with the gateways?

So what kind of IoT devices use these protocols to enroll certs? How do they use the certs? Do they use it only for authentication? Or also for encrypting communication? Are they sophisticated enough to do this?

  • Certificates are essential for 2 things, i. communication , ii. authenticate the firmware/software update. Low level hardware like sensor will not interact with certificate. Just go check OSI layer, IoTs are similar to any networking device.
    – mootmoot
    Jun 18, 2018 at 12:13
  • 2
    This question should be closed as too broad, but I can't vote to close due to a bounty. “IoT” covers a vast range of different devices and vendors. IoT devices get certificates if the vendor felt like it. That's all there is to it. Jun 20, 2018 at 6:10

4 Answers 4


IoT covers a broad range of devices and use cases, like at home the router, smart light bulbs, smart thermostat, maybe smart locks etc. And even more cases can be found in the industry where sensors or data collection systems are everywhere.

Given the broad range of devices they have some things in common: they have some firmware which might have bugs or missing features and thus need to get updates. And they need to communicate with other systems to receive and/or provide collected data.

And this is where certificates (or other trusted containers for a public key) help:

  • It is essential in most use cases that the device only runs authorized firmware, i.e. no firmware which can be used to destroy the IoT device or even attack connected machines, sensors or other devices in the network. Digital signatures using certificates are typically used to provide such authorization.
  • In order to protect the data in transit encryption is usually required. This requires that the client knows that it transmits the data to the correct server. Certificates are typically used for this server authentication, for example in protocols like TLS. Alternatively the client does not trust the server it is directly talking to at all, but instead encrypts the data so that only the ultimate recipient can decrypt these. In this case the client can use protocols like PGP, S/MIME or similar to encrypt the data for the final recipients by having the recipients certificate.
  • Often it is also necessary that the recipient of some data knows for sure which device is sending/creating the data to make sure that it does not get fake data from unauthorized devices. Again certificates are used for this: either in the form of client certificates within mutual authentication in protocols like TLS. Or by digitally signing the data using a device specific certificate.

Or also for encrypting communication?

Certificates use public key (asymmetric) cryptography, i.e. RSA or ECC. This kind of cryptography is not suitable to encrypt large amounts of data. Instead symmetric cryptography is used for this (i.e. AES and similar). Certificates still play an important role in encryption in that they are used to protect the symmetric keys used for encryption, for example in the key exchange in TLS or to encrypt the symmetric key with the recipients public key in protocols like PGP or S/MIME.

I am assuming that sensors etc are too small to get certificates and use them?

Public key cryptography as the central part of certificate is not that resource intensive as one might think. It is for example already implemented in smart cards or TPM chips which means that it can probably be implemented also in most IoT devices which are capable enough to do some kind of network communication. The usual use cases for public key cryptography within IoT require only the occasional creation or verification of digital signatures or encryption of small data, which means that speed of the operation is usually not that critical.

  • Smart cards & TPM chips are not particularly IoT devices. The primary purpose of a smart card or TPM chip is to hold certificates. I am asking for e.g. of IoT devices which support certificate enrolment protocols & can use the certificates
    – user93353
    Jun 24, 2018 at 8:39
  • @user93353: I did not mean to claim that smart cards are IoT devices and TPM chips are definitely not a IoT device. I mention these to show that the necessary parts to use certificates do not need much resources. I've edited the answer to make it more clear. Jun 24, 2018 at 9:01

Note that the EST protocol has the /serverkeygen method. This method could be ideal for your use case:

4.4.  Server-Side Key Generation

   An EST client may request a private key and associated certificate
   from an EST server using an HTTPS POST with an operation path value
   of "/serverkeygen".  Support for the /serverkeygen function is

It means that a device can request a certificate without generating its own private key. It only has to post a CSR with a bogus key, and the server generates a new public key, and inserts it into the returned X.509 certificate. Both, the X.509 certificate and the private key, are returned in a "multipart/mixed" HTTP response consisting of two parts: one part is the private key data and the other part is the certificate data.

Optionally, for extra security, the server-side generated key may be encrypted using an asymmetric key agreed by the EST server and the IoT device.

This method is pretty well documented in the Section 4.4 in the EST RFC (https://www.rfc-editor.org/rfc/rfc7030#section-4.4).


I'd say that certificates are an important part of the security of an IoT devices, not the most important.

Think of an IoT device use case? Is it a connected Light Bulb? Then is the web site that the App connects to control the bulb more important to protect than the bulb itself (which uses Zigbee)? Or is it an open platform that has a web app running on it? then make sure the OWASP Top Ten is being used to harden the app.

IoT Security falls in to a multitude of areas Device, Communication and Cloud. Putting one above the other is not a good strategy.


The question is certainly very broad; it's a bit like asking "what devices can use an internet connection?"

We should first establish why we need certificates.

Secure Communication

With a valid certificate, a device can verify the identity of a remote host. Combined with encryption of communications, you can be reasonably sure that nobody is tampering with or reading your messages.

Signature Validation

Firmware updates are usually signed by the manufacturer. Devices only accept an update if they can verify its signature. They check the signature against a certificate installed by the manufacturer.

So, broadly speaking, any device that communicates or updates can make use of certificates, because public-key cryptography is fundamental to keeping these things secure.

  • I know how certificates can be used. My question is about whether a typical IoT device is equipped to use it.
    – user93353
    Jun 24, 2018 at 2:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .