I develop IoT (Internet of Things) devices on small embedded systems, where it is very difficult to update the local certificate once they have been deployed. It really needs to be avoid if it can.
With the new 39 month age for TLS certificates, I am trying to understand how this will effect my development options.
I will usually install a Root CA from Baltimore or others on the device during the manufacturing process. But will this now mean that I will need to update the certificate on my device every 39 months?
Or have I misunderstood what is going on. Will it only be the servers's certificate I need to replace and not the root CA on the device?
Basically I need to understand what can I do to ensure I do not need to replace the certificate for the entire life of the device. Hence it will need to be in the 10 years + time frame.
Embedded Device <----Internet----> Cloud Service (Server)
The Embedded Device is the client which has a ROOT CA installed to enable direct communication over TLS 1.2 with the Cloud Service (Server)
The type of devices we are talking about are small embedded devices like those used in smart meters or sensor nodes for factories or agriculture. They could be deployed into the millions potentially.