Using CA Signed X.509 Certificate in IoT Hub for Edge Device Authentication

Satyam Chauhan 492

Hi,

I have setup a IoT Hub which has to receive data from an edge device. the edge device is a custom Iot edge module developed using C# SDK. I have to use a CA signed certificate, but I don't see the option to select CA signed certificate while creating a Edge device in IoT Hub, also I cannot use device provisioning service.

User's image

Please provide a way how to use CA signed certificate for IoT edge Devices.

AshokPeddakotla-MSFT 27,386 Reputation points

2024-03-19T09:03:41.1+00:00

Satyam Chauhan Greetings!

Are you using this as a downstream device?

Note that downstream devices need to be identified in IoT Hub as regular IoT devices, not IoT Edge devices.

AFAIK, IoT Hub currently doesn't support X.509 CA authentication directly with IoT Edge.

See Understand how Azure IoT Edge uses certificates and Authenticate a downstream device to Azure IoT Hub for more details.
Sander van de Velde 28,386 Reputation points MVP

2024-03-19T21:46:18.8333333+00:00

Hello @Satyam Chauhan

The Azure IoT Device Provisioning Service is perfect for X509 authentication, like here, in the individual enrollment.

What is the reason for not being able to use the Azure IoT Device Provisioning Service?
Satyam Chauhan 492 Reputation points

2024-03-20T05:16:30.05+00:00

Hi @Sander van de Velde ,

We are connecting the IoT hub and IoT edge using site-to-site VPN connectivity, all the connectivity is through private network only, so if we add DPS now then it will require whitelisting of DPS in the on-premise side, which is not possible now.

I have a follow up question for this, so since we are using site-to-site VPN connectivity and IoT hub without DPS only support Self-signed X.509 certificate, so what kind of certificate should be used, my understanding is internal certificate should be used as the IoT Hub is private and DNS verification cannot be done as IoT edge is in on-premise without Internet.

Can you please suggest if we have to go with self signed certificate then what procedure should be followed for production scenario, for test purpose we followed - https://learn.microsoft.com/en-us/azure/iot-edge/how-to-create-test-certificates?view=iotedge-1.4&tabs=linux this article but I am not sure the certificates generated using this can be used in production environment.