How to create a certificate based on the Custom specification in OnBoard™ IoT Security

This article will guide you on how to create a certificate based on the Custom specification in OnBoard™ IoT Security (OBIS).

Prerequisites

Before getting started, please ensure that you have OBIS role permissions as a System Manager or Resource Manager.

Instructions

tip

After a custom certificate template is created, it can be selected when configuring Certificates for a product.

1. Sign in to OBIS.

2. In the Core section of the left menu, click PKI, and then click Create on the PKI page.

   

Create a root certificate

tip

The default mode is simple mode, which requires only basic information. If you need to configure additional fields for the system-generated certificate, you can switch to advanced mode by clicking Advanced Mode in the top-right corner of the page.

1. On the Basic Info section, select Generate by System or Bring Your Own Certificate as needed.

   

   Description of root certificate basic information:

   Information	Generate by System	Bring Your Own Certificate
   Name	The root certificate name must be unique in the same environment.
   Environment	Two environments can be selected: TEST and PROD.
   Specification	Select the Custom specification.
   Level Name	Default is Root Cert.
   Generation Method	No file upload is required.	Click the Add icon to select and upload a root certificate in .pem format, or directly drag and drop your own root certificate into the upload area.
   Validity Period	You can choose Duration, Specific Date, or Never Expires to set the validity period as needed.	Automatically parsed from the certificate content and can't be modified.
   Algorithm	Available algorithms for the certificates. Options include: RSA_2048 RSA_3072 RSA_4096 ECC_P384 ECC_P256 ECC_P521	Automatically parsed from the certificate content and can't be modified.
   Signature Algorithm	Signature algorithms for the certificates. Options include: SHA256WITHRSA SHA384WITHRSA SHA512WITHRSA SHA256WITHECDSA SHA256WITHECDSA	Automatically parsed from the certificate content and can't be modified.
   Common Name	Name of certificate holder.	Automatically parsed from the certificate content and can't be modified.
   Organization (O)	Organizational name.	N/A
   Organizational Unit (OU)	Organizational unit name.	N/A
   Country	Two ISO country codes.	N/A
   State / Province	State or province name.	N/A
   Locality (L)	City name.	N/A
   Email	User email.	N/A
   Key Usage	Optional key usages, such as Digital Signature, Non Repudiation, and Key Encipherment.	Automatically parsed from the certificate content and can't be modified.
   Notes	Provide additional information related to the root certificate, such as special requirements and important notes.

   The configuration of advanced mode

   The configuration of advanced mode

   

   • Description of Basic information:

     Information	Description
     Version	The standard version and can't be modified.
     Renew	When enabled, certificates can be renewed. The existing public key is retained, and a new certificate is issued with an extended validity period.
     Algorithm	Available algorithms for the certificates. Options include: RSA_2048 RSA_3072 RSA_4096 ECC_P384 ECC_P256 ECC_P521
     Signature Algorithm	Signature algorithms for the certificates. Options include: SHA256WITHRSA SHA384WITHRSA SHA512WITHRSA SHA256WITHECDSA SHA256WITHECDSA

   • Description of Validation Service information:

     Information	Description
     CRL	Automatically parsed from the certificate content, you can set the Full Update Period, Delta Update Period, and Overlap Time.
     OSCP	Automatically parsed from the certificate content, you can set the Response Validity and Nonce.
     CA Issuers	When enabled, the issuing CA certificate download service will be provided.

   • Description of Subject DN information:

     tip

     At least one Subject DN information must be provided.

     Information	Description
     Common Name	Name of certificate holder.
     Organization (O)	Organizational name.
     Organizational Unit (OU)	Organizational unit name.
     Country	Two ISO country codes.
     State / Province	State or province name.
     Locality (L)	City name.
     Email	User email.
     Custom Add	Custom OIDs can be added.

   • Description of Extensions information:

     tip

     If the Critical checkbox for a certain item is selected, the system must recognize and support that item when processing the certificate; otherwise, the certificate will be rejected.

     Information	Description
     Basic Constraints	Confirm if it is a CA certificate.
     Path Length	Limits the number of sub-certificates.
     Key Usage	Optional key usages, such as Digital Signature, Key Cert Sign, and CRL Sign.
     Extended Key Usage (EKU)	Optional extended key usages, such as Server Auth, Client Auth, and Code Signing.

2. After verifying that the information is correct, click Create to complete the root certificate creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

Create an intermediate certificate

info

Before creating an intermediate certificate, please ensure that at least one root certificate has been created so that it can be selected and inherited during configuration.

tip

The default mode is simple mode, which requires only basic information. If you need to configure additional fields for the system-generated certificate, you can switch to advanced mode by clicking Advanced Mode in the top-right corner of the page.

1. On the PKI page, click the Options icon for the corresponding root certificate and select Add.

   

2. On the Basic Info section, select and enter the basic information.

   • If the intermediate certificate is inherited from your own root certificate, you can select Generate by System or Bring Your Own Certificate as needed

     

     Information	Generate by System	Bring Your Own Certificate
     Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
     Environment	The environment is inherited from the root certificate.
     Issuer	The inherited root certificate.
     Specification	Default is Custom.
     Level Name	Default is Sub Cert.
     Generation Method	No file upload is required.	Click the Add icon to select and upload a intermediate certificate in .pem format, or directly drag your own intermediate certificate into the upload area.
     Validity Period	The validity period will be inherited from the root certificate.	Automatically parsed from the certificate content and can't be modified.
     Algorithm	Available algorithms for the certificates. Options include: RSA_2048 RSA_3072 RSA_4096 ECC_P384 ECC_P256 ECC_P521	Automatically parsed from the certificate content and can't be modified.
     Signature Algorithm	Signature algorithms for the certificates. Options include: SHA256WITHRSA SHA384WITHRSA SHA512WITHRSA SHA256WITHECDSA SHA256WITHECDSA	Automatically parsed from the certificate content and can't be modified.
     Common Name	Name of certificate holder.	Automatically parsed from the certificate content and can't be modified.
     Organization (O)	Organizational name.	N/A
     Organizational Unit (OU)	Organizational unit name.	N/A
     Country	Two ISO country codes.	N/A
     State / Province	State or province name.	N/A
     Locality (L)	City name.	N/A
     Email	User email.	N/A
     Key Usage	Optional key usages, such as Digital Signature, Non Repudiation, and Key Encipherment.	Automatically parsed from the certificate content and can't be modified.
     Notes	Provide additional information related to the intermediate certificate, such as special requirements and important notes.

   • If the intermediate certificate is inherited from the system-generated root certificate

     

     Information	Description
     Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
     Environment	The environment is inherited from the root certificate.
     Issuer	The inherited root certificate.
     Specification	Default is Custom.
     Level Name	Default is Sub Cert.
     Validity Period	You can choose Duration, Specific Date, or Never Expires to set the validity period as needed. Setting an expiration date beyond that of the inherited certificate may result in certificate chain validation failures, client trust issues, and audit risks.
     Algorithm	Available algorithms for the certificates. Options include: RSA_2048 RSA_3072 RSA_4096 ECC_P384 ECC_P256 ECC_P521
     Signature Algorithm	Signature algorithms for the certificates. Options include: SHA256WITHRSA SHA384WITHRSA SHA512WITHRSA SHA256WITHECDSA SHA256WITHECDSA
     Common Name	Name of certificate holder.
     Organization (O)	Organizational name.
     Organizational Unit (OU)	Organizational unit name.
     Country	Two ISO country codes.
     State / Province	State or province name.
     Locality (L)	City name.
     Email	User email.
     Key Usage	Optional key usages, such as Digital Signature, Non Repudiation, and Key Encipherment.
     Notes	Provide additional information related to the intermediate certificate, such as special requirements and important notes.

   The configuration of advanced mode

   The configuration of advanced mode

   

   • Description of Basic information:

     Information	Description
     Version	The standard version and can't be modified.
     Renew	When enabled, certificates can be renewed. The existing public key is retained, and a new certificate is issued with an extended validity period.
     Algorithm	Available algorithms for the certificates. Options include: RSA_2048 RSA_3072 RSA_4096 ECC_P384 ECC_P256 ECC_P521
     Signature Algorithm	Signature algorithms for the certificates. Options include: SHA256WITHRSA SHA384WITHRSA SHA512WITHRSA SHA256WITHECDSA SHA256WITHECDSA

   • Description of Validation Service information:

     Information	Description
     CRL	Automatically parsed from the certificate content, you can set the Full Update Period, Delta Update Period, and Overlap Time.
     OSCP	Automatically parsed from the certificate content, you can set the Response Validity and Nonce.
     CA Issuers	When enabled, the issuing CA certificate download service will be provided.

   • Description of Subject DN information:

     tip

     At least one Subject DN information must be provided.

     Information	Description
     Common Name	Name of certificate holder.
     Organization (O)	Organizational name.
     Organizational Unit (OU)	Organizational unit name.
     Country	Two ISO country codes.
     State / Province	State or province name.
     Locality (L)	City name.
     Email	User email.
     Custom Add	Custom OIDs can be added.

   • Description of Extensions information:

     tip

     If the Critical checkbox for a certain item is selected, the system must recognize and support that item when processing the certificate; otherwise, the certificate will be rejected.

     Information	Description
     Basic Constraints	Confirm if it is a CA certificate.
     Path Length	Limits the number of sub-certificates.
     Key Usage	Optional key usages, such as Digital Signature, Key Cert Sign, and CRL Sign.
     Extended Key Usage (EKU)	Optional extended key usages, such as Server Auth, Client Auth, and Code Signing.

3. After verifying that the information is correct, click Create to complete the intermediate certificate creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

   When creating an intermediate certificate, if the issuer is your own root certificate, you must complete the CSR (Certificate Signing Request) configuration for the intermediate certificate. Before the CSR configuration is completed, the certificate will remain in the Pending status and can't be used.

CSR configuration steps for the intermediate certificate

tip

When creating an intermediate certificate, if the issuer is your own root certificate, refer to the following steps to complete the CSR configuration.

1. On the PKI page, expand the corresponding certificate chain, and then click the corresponding intermediate certificate.

2. Locate the CSR Configuration section on the certificate page, click the Download icon to download the CSR file. Then, use your Root CA (Certificate Authority) to sign the file, thereby generating an intermediate certificate signed by the Root CA.

   

3. After an intermediate certificate is generated, click the Add icon in the upload area, select and upload the intermediate certificate in .pem format, or directly drag and drop your intermediate certificate into the upload area.

4. Click Submit. Once the configuration is completed, the intermediate certificate status will change to Normal.

Create an end entity template

info

Before creating an end entity template, please ensure that at least one root certificate or intermediate certificate has been created so that it can be selected and inherited during configuration.

tip

The default mode is simple mode, which requires only basic information. If you need to configure additional fields for the system-generated certificate, you can switch to advanced mode by clicking Advanced Mode in the top-right corner of the page.

1. On the PKI page, expand the corresponding certificate chain, click the Options icon for the corresponding root or intermediate certificate and select Add.

   

2. On the Basic Info section, select and enter the basic information.

   

   Description of end entity template basic information:

   Information	Description
   Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
   Environment	The environment is inherited from the root or intermediate certificate.
   Issuer	The inherited root or intermediate certificate.
   Specification	Default is Custom.
   Level Name	Default is Leaf Cert.
   Validity Period	Set the validity period of the end entity template. Setting an expiration date beyond that of the inherited certificate may result in certificate chain validation failures, client trust issues, and audit risks. Note: If the end entity template is inherited from your own root or intermediate certificate, the validity period will be inherited from the root or intermediate certificate.
   Algorithm	Available algorithms for the certificates. Options include: RSA_2048 RSA_3072 RSA_4096 ECC_P384 ECC_P256 ECC_P521
   Signature Algorithm	Signature algorithms for the certificates. Options include: SHA256WITHRSA SHA384WITHRSA SHA512WITHRSA SHA256WITHECDSA SHA256WITHECDSA
   Common Name	Name of certificate holder.
   Organization (O)	Organizational name.
   Organizational Unit (OU)	Organizational unit name.
   Country	Two ISO country codes.
   State / Province	State or province name.
   Locality (L)	City name.
   Email	User email.
   Key Usage	Optional key usages, such as Digital Signature, Non Repudiation, and Key Encipherment.
   Notes	Provide additional information related to the end entity certificate, such as special requirements and important notes.

   The configuration of advanced mode

   The configuration of advanced mode

   

   • Description of Basic information:

     Information	Description
     Version	The standard version and can't be modified.
     Renew	When enabled, certificates can be renewed. The existing public key is retained, and a new certificate is issued with an extended validity period.
     Algorithm	Available algorithms for the certificates. Options include: RSA_2048 RSA_3072 RSA_4096 ECC_P384 ECC_P256 ECC_P521
     Signature Algorithm	Signature algorithms for the certificates. Options include: SHA256WITHRSA SHA384WITHRSA SHA512WITHRSA SHA256WITHECDSA SHA256WITHECDSA

   • Description of Subject DN information:

     tip

     At least one Subject DN information must be provided.

     Information	Description
     Common Name	Name of certificate holder.
     Organization (O)	Organizational name.
     Organizational Unit (OU)	Organizational unit name.
     Country	Two ISO country codes.
     State / Province	State or province name.
     Locality (L)	City name.
     Email	User email.
     Custom Add	Custom OIDs can be added.

   • Description of Extensions information:

     tip

     If the Critical checkbox for a certain item is selected, the system must recognize and support that item when processing the certificate; otherwise, the certificate will be rejected.

     Information	Description
     Basic Constraints	Confirm if it is a CA certificate.
     Key Usage	Optional key usages, such as Digital Signature, Key Cert Sign, and CRL Sign.
     Extended Key Usage (EKU)	Optional extended key usages, such as Server Auth, Client Auth, and Code Signing.

3. After verifying that the information is correct, click Create to complete the end entity template creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

   When creating an end entity template, if the issuer is your own root or intermediate certificate, you must complete the CSR (Certificate Signing Request) configuration for the end entity template. Before the CSR configuration is completed, the template will remain in the Pending status and can't be used.

CSR configuration steps for the end entity template

tip

When creating an end entity template, if the issuer is your own root or intermediate certificate, refer to the following steps to complete the CSR configuration.

1. On the PKI page, expand the corresponding certificate chain, and then click the corresponding end entity template.

2. Locate the CSR Configuration section on the certificate page, click the Download icon to download the CSR file. Then, use your Root CA (Certificate Authority) to sign the file, thereby generating an end entity template signed by the Root CA.

   

3. After an end entity template is generated, click the Add icon in the upload area, select and upload the end entity template in .pem format, or directly drag and drop your end entity template into the upload area.

4. Click Submit. Once the configuration is completed, the end entity template status will change to Normal.