Azure IoT Edge
An Azure service that is used to deploy cloud workloads to run on internet of things (IoT) edge devices via standard containers.
598 questions
Using CA Signed X.509 Certificate in IoT Hub for Edge Device Authentication
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(224.00000000000003, 98%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESC%3C/text%3E%3C/svg%3E)
Satyam Chauhan
607
Reputation points
Hi,
I have setup a IoT Hub which has to receive data from an edge device. the edge device is a custom Iot edge module developed using C# SDK. I have to use a CA signed certificate, but I don't see the option to select CA signed certificate while creating a Edge device in IoT Hub, also I cannot use device provisioning service.
Please provide a way how to use CA signed certificate for IoT edge Devices.
Azure IoT Edge
Azure IoT Hub
Azure IoT Hub
An Azure service that enables bidirectional communication between internet of things (IoT) devices and applications.
1,269 questions
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 74%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAM%3C/text%3E%3C/svg%3E)
AshokPeddakotla-MSFT 35,971 Reputation points Moderator2024-03-19T09:03:41.1+00:00 Satyam Chauhan Greetings!
Are you using this as a downstream device?
Note that downstream devices need to be identified in IoT Hub as regular IoT devices, not IoT Edge devices.
AFAIK, IoT Hub currently doesn't support X.509 CA authentication directly with IoT Edge.
See Understand how Azure IoT Edge uses certificates and Authenticate a downstream device to Azure IoT Hub for more details.
-
Sander van de Velde | MVP 36,526 Reputation points MVP Volunteer Moderator2024-03-19T21:46:18.8333333+00:00 Hello @Satyam Chauhan
The Azure IoT Device Provisioning Service is perfect for X509 authentication, like here, in the individual enrollment.
What is the reason for not being able to use the Azure IoT Device Provisioning Service?
-
Satyam Chauhan 607 Reputation points
2024-03-20T05:16:30.05+00:00 Hi @Sander van de Velde | MVP ,
We are connecting the IoT hub and IoT edge using site-to-site VPN connectivity, all the connectivity is through private network only, so if we add DPS now then it will require whitelisting of DPS in the on-premise side, which is not possible now.
I have a follow up question for this, so since we are using site-to-site VPN connectivity and IoT hub without DPS only support Self-signed X.509 certificate, so what kind of certificate should be used, my understanding is internal certificate should be used as the IoT Hub is private and DNS verification cannot be done as IoT edge is in on-premise without Internet.
Can you please suggest if we have to go with self signed certificate then what procedure should be followed for production scenario, for test purpose we followed - https://learn.microsoft.com/en-us/azure/iot-edge/how-to-create-test-certificates?view=iotedge-1.4&tabs=linux this article but I am not sure the certificates generated using this can be used in production environment.
Sign in to comment
Sign in to answer