I'm rather confused about self-signed certificates. I would be grateful if anyone can clear up my confusion.
I'm working with Amazon AWS IoT, and in order to create our own certificates on a device to communicate with the cloud, we must first create and register our own CA certificate.
We first create the CA private key, then the CA certificate which is signed with that private key.
We then create a device private key and a device CSR with that private key.
We then combine the CA private key with the CA certificate and the device CSR to produce the device certificate which gets registered on the cloud for future comparison when the device wishes to connect to it securely.
Do we need to keep both private keys at this point? (both CA private key and device private key)
Can we even just throw away the private keys because the device certificate and CA certificate is already generated?
Don't we just need to send the certificate to the cloud when initiating a secure connection and then the cloud uses the public keys to verify that it actually came from the device?