01
Shared secrets in firmware
A key or password flashed into every unit of a product line cannot name a single device. If it leaks, every device built with it is suspect and none can be revoked on its own.
Why device identity breaks at fleet scale
Manufacturers of connected products, from smart meters to vehicles and medical devices, run into the same three problems.
02
Long field life
Industrial, energy and automotive devices stay in service for 10 to 20 years. Certificates, algorithms and the CA itself must be renewable without recalling the device.
03
Regulation
The EU Cyber Resilience Act, IEC 62443 for industrial systems and UN R155 for vehicles all expect secure-by-design products with authenticated communication and a way to handle vulnerabilities over the support period.
How factory provisioning works with DuoKey PKI
Create (or import) a dedicated issuing CA for devices, separate from your server and user CAs, so it can be revoked and rotated on its own. Its signing key can stay in an HSM, a cloud KMS or an MPC vault: every certificate, CRL and OCSP response is signed there and the key is never exported.
On the line: each device generates its key pair, on its secure element when it has one, and enrols with its serial number as subject over EST (RFC 7030) or CMP (RFC 4210 / 9483), authenticated with a bootstrap secret you rotate per batch or per line.
In the field: CMP key update is signed by the device's current key, so a stolen bootstrap secret alone cannot renew another device's identity. EST re-enrolment is also available.
At end of life or compromise: revoke one device from the console, the API or CMP; relying parties see it through OCSP or the next CRL.
Network equipment and MDM: SCEP (RFC 8894) profiles, with optional Microsoft Intune request validation. SCEP decrypts requests with the CA key, so it runs on a CA whose RSA key is held by the platform rather than in a vault.
Key Benefits
What a per-device identity gives a manufacturer
Revoke one device, not a product line
Each unit has its own certificate, so a cloned or stolen device is revoked on its own while the rest of the fleet keeps working.
CA key under your control
The device CA signs from an HSM, a cloud KMS or an MPC vault, with an M-of-N quorum on CA revocation and template changes.
Proven at automotive scale
DuoKey PKI runs device identity in production at Volkswagen. Contact DuoKey to size a deployment against your enrolment and renewal rates.
Ready for post-quantum
Issue ML-DSA, SLH-DSA or hybrid ML-DSA-65 + ECDSA-P256 certificates alongside RSA and ECC, so long-lived devices are not locked into one algorithm.
Next step
Still weighing the control model?
Bring the constraint. We’ll map the shortest practical path.
Give your next production batch its own identities
Talk to us about factory provisioning over EST or CMP with DuoKey PKI.
Trust
Assurance and customer programmes
Customer programmes