I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT.
On my device side, I have a device certificate ( deviceCert.crt ) and the device certificate private key ( deviceCert.key ) , and also the root CA certificate from Amazon (root-CA.crt)
The device certificate is of course already registered on the AWS cloud.
I realize when using an MQTT client on the device that it requires the device to contain both the device certificate and the device private key during authentication.
Why isn't the private key enough to have on the device? My guess was that the device would sign something with the device private key , and on the server end, it would use the public key from the device certificate (already stored there) to verify the signature.
Or does the device send the device certificate to the server and the server compares it with the one it has stored?
What happens exactly here?