Each freshly installed sensor creates its own keys and a first, self-signed certificate. The factory image contains no shared device key and no CA signing key. Verify that first certificate's fingerprint against the sensor's setup record.
Use your own CA
- Under Security on the sensor's website, enter the sensor's DNS names and generate a CSR. The private key stays on the sensor.
- Have your CA sign the CSR.
- Import the signed certificate chain and your CA's trust bundle. The sensor checks the key, names, dates, server purpose and chain before activating it, and keeps the previous certificate if the web server fails to reload.
Keep your CA's signing key on a separate system, and install its public certificate on each client. A certificate identifies the sensor; credentials still decide what each caller may do.
Renew automatically with ACME
Point Security at your private CA's HTTPS ACME directory and its trust bundle. The CA must resolve the sensor's DNS name and reach its HTTP-01 challenge on port 80; everything else on port 80 redirects to HTTPS. The sensor's clock must be correct. Security shows expiry and renewal failures, and a failed renewal keeps the working certificate.
Clients that pin the fingerprint need the new pin after a certificate changes. Clients that trust the CA do not.
Not in this release
Hosted CA enrolment, revocation distribution and device attestation. Revoke a credential to withdraw API access immediately.