A PKI is what makes certificates trustworthy. A certificate authority (CA) signs each device’s X.509 certificate; the platform trusts the CA’s root, so it can verify any device the CA has signed without a pre-shared secret. The same mechanism lets devices verify the server during a TLS handshake, which prevents redirection to a fake backend.
Running a PKI for devices raises practical questions: where the root key lives (usually an HSM), how certificates get onto devices on the production line, how long they last, and how revocation reaches devices that are rarely online. Managed services and enrollment standards such as the IETF’s EST help, but the policy decisions remain yours. Device identity, certificates and PKI for IoT covers them.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.