# Certificates

> Give the sensor an HTTPS certificate from your own CA, by CSR or ACME, and verify it from your clients.

Each freshly installed sensor creates its own keys and a first, self-signed certificate. The factory
image contains no shared device key and no CA signing key. Verify that first certificate's
fingerprint against the sensor's setup record.

## Use your own CA

1. Under **Security** on the sensor's website, enter the sensor's DNS names and generate a CSR. The
   private key stays on the sensor.
2. Have your CA sign the CSR.
3. Import the signed certificate chain and your CA's trust bundle. The sensor checks the key, names,
   dates, server purpose and chain before activating it, and keeps the previous certificate if the
   web server fails to reload.

Keep your CA's signing key on a separate system, and install its public certificate on each client.
A certificate identifies the sensor; credentials still decide what each caller may do.

## Renew automatically with ACME

Point **Security** at your private CA's HTTPS ACME directory and its trust bundle. The CA must
resolve the sensor's DNS name and reach its HTTP-01 challenge on port 80; everything else on port 80
redirects to HTTPS. The sensor's clock must be correct. Security shows expiry and renewal failures,
and a failed renewal keeps the working certificate.

Clients that pin the fingerprint need the new pin after a certificate changes. Clients that trust
the CA do not.

## Not in this release

Hosted CA enrolment, revocation distribution and device attestation. Revoke a credential to withdraw
API access immediately.