How to create a certificate based on the Matter specification in OnBoard™ IoT Security

This article will guide you on how to create a certificate based on the Matter specification in OnBoard™ IoT Security (OBIS).

Prerequisites

Before getting started, please ensure that you have OBIS role permissions as a System Manager or Resource Manager.

Instructions

tip

After a certificate template based on the Matter specification is created, it can be selected when configuring Certificates for a product.

1. Sign in to OBIS.

2. In the Core section of the left menu, click PKI, and then click Create on the PKI page.

   

Create a PAA certificate based on the Matter specification

tip

The default mode is simple mode, which requires only basic information. If you need to configure additional fields for the system-generated certificate, you can switch to advanced mode by clicking Advanced Mode in the top-right corner of the page.

1. On the Basic Info section, select Generate by System or Bring Your Own Certificate as needed.

   

   Description of PAA certificate basic information:

   Information	Generate by System	Bring Your Own Certificate
   Name	The PAA certificate name must be unique in the same environment.
   Environment	Two environments can be selected: PROD and TEST.
   Specification	Select the Matter specification.
   Level Name	Default is PAA.
   Generation Method	No file upload is required.	Click the Add icon to select and upload a PAA certificate in .pem format, or directly drag your own PAA certificate into the upload area.
   Validity Period	You can choose Duration, Specific Date, or Never Expires to set the validity period as needed.	Automatically parsed from the certificate content and can't be modified.
   Common Name	Name of certificate holder.	Automatically parsed from the certificate content and can't be modified.
   Matter VID	Matter vendor ID.	N/A
   Notes	Provide additional information related to the PAA certificate, such as special requirements and important notes.

   The configuration of advanced mode

   The configuration of advanced mode

   

   • Description of Basic information:

     Information	Description
     Version	The standard version and can't be modified.
     Renew	When enabled, certificates can be renewed. The existing public key is retained, and a new certificate is issued with an extended validity period.
     Algorithm	Automatically parsed from the certificate content and can't be modified.
     Signature Algorithm	Automatically parsed from the certificate content and can't be modified.

   • Description of Validation Service information:

     Information	Description
     CRL	Automatically parsed from the certificate content, you can set the Full Update Period.

   • Description of Subject DN information:

     Information	Description
     Common Name	Name of certificate holder.
     Organization (O)	Organizational name.
     Organizational Unit (OU)	Organizational unit name.
     Country	Two ISO country codes.
     State / Province	State or province name.
     Locality (L)	City name.
     Email	User email.
     Matter VID	Matter vendor ID.

   • Description of Extensions information:

     tip

     If the Critical checkbox for a certain item is selected, the system must recognize and support that item when processing the certificate; otherwise, the certificate will be rejected.

     Information	Description
     Basic Constraints	Confirm if it is a CA certificate.
     Path Length	Limits the number of sub-certificates.
     Key Usage	Optional key usages, such as Digital Signature, Key Cert Sign, and CRL Sign.
     Extended Key Usage (EKU)	Optional extended key usages, such as Server Auth, Client Auth, and Code Signing.

2. After verifying that the information is correct, click Create to complete the PAA certificate creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

Create a PAI certificate based on the Matter specification

info

Before creating a PAI certificate based on the Matter specification, please ensure that at least one PAA certificate based on the Matter specification has been created so that it can be selected and inherited during configuration.

tip

The default mode is simple mode, which requires only basic information. If you need to configure additional fields for the system-generated certificate, you can switch to advanced mode by clicking Advanced Mode in the top-right corner of the page.

1. On the PKI page, click the Options icon for the corresponding PAA certificate and select Add.

   

2. On the Basic Info section, select and enter the basic information.

   • If the PAI certificate is inherited from your own PAA certificate, you can select Generate by System or Bring Your Own Certificate as needed

     

     Information	Generate by System	Bring Your Own Certificate
     Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
     Environment	The environment is inherited from the PAA certificate.
     Issuer	The inherited PAA certificate.
     Specification	Default is Matter.
     Level Name	Default is PAI.
     Generation Method	No file upload is required.	Click the Add icon to select and upload a PAI certificate in .pem format, or directly drag your own PAI certificate into the upload area.
     Validity Period	The validity period will be inherited from the PAA certificate.	Automatically parsed from the certificate content and can't be modified.
     Common Name	Name of certificate holder.	Automatically parsed from the certificate content and can't be modified.
     Matter VID	Matter vendor ID.	N/A
     Matter PID	Matter product ID.	N/A
     Notes	Provide additional information related to the PAI certificate, such as special requirements and important notes.

   • If the PAI certificate is inherited from the system-generated PAA certificate

     

     Information	Description
     Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
     Environment	The environment is inherited from the PAA certificate.
     Issuer	The inherited PAA certificate.
     Specification	Default is Matter.
     Level Name	Default is PAI.
     Validity Period	You can choose Duration, Specific Date, or Never Expires to set the validity period as needed. Setting an expiration date beyond that of the inherited certificate may result in certificate chain validation failures, client trust issues, and audit risks.
     Common Name	Name of certificate holder.
     Matter VID	Matter vendor ID.
     Matter PID	Matter product ID.
     Notes	Provide additional information related to the PAI certificate, such as special requirements and important notes.

   The configuration of advanced mode

   The configuration of advanced mode

   

   • Description of Basic information:

     Information	Description
     Version	The standard version and can't be modified.
     Algorithm	Automatically parsed from the certificate content and can't be modified.
     Signature Algorithm	Automatically parsed from the certificate content and can't be modified.

   • Description of Validation Service information:

     Information	Description
     CRL	Automatically parsed from the certificate content, you can set the Full Update Period.

   • Description of Subject DN information:

     tip

     At least one Subject DN information must be provided.

     Information	Description
     Common Name	Name of certificate holder.
     Organization (O)	Organizational name.
     Organizational Unit (OU)	Organizational unit name.
     Country	Two ISO country codes.
     State / Province	State or province name.
     Locality (L)	City name.
     Email	User email.
     Matter VID	Matter vendor ID.
     Matter PID	Matter product ID.

   • Description of Extensions information:

     tip

     If the Critical checkbox for a certain item is selected, the system must recognize and support that item when processing the certificate; otherwise, the certificate will be rejected.

     Information	Description
     Basic Constraints	Confirm if it is a CA certificate.
     Path Length	Limits the number of sub-certificates.
     Key Usage	Optional key usages, such as Digital Signature, Key Cert Sign, and CRL Sign.
     Extended Key Usage (EKU)	Optional extended key usages, such as Server Auth, Client Auth, and Code Signing.

3. After verifying that the information is correct, click Create to complete the PAI certificate creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

   When creating a PAI certificate, if the issuer is your own PAA certificate, you must complete the CSR (Certificate Signing Request) configuration for the PAI certificate. Before the CSR configuration is completed, the certificate will remain in the Pending status and can't be used.

CSR configuration steps for the PAI certificate

tip

When creating a PAI certificate, if the issuer is your own PAA certificate, refer to the following steps to complete the CSR configuration.

1. On the PKI page, expand the corresponding certificate chain, and then click the corresponding PAI certificate.

2. Locate the CSR Configuration section on the certificate page, click the Download icon to download the CSR file. Then, use your Root CA to sign the file, thereby generate a PAI certificate signed by the Root CA.

   

3. After a PAI certificate is generated, click the Add icon in the upload area, select and upload the PAI certificate in .pem format, or directly drag and drop your PAI certificate into the upload area.

4. Click Submit. Once the configuration is completed, the PAI certificate status will change to Normal.

Create a DAC template based on the Matter specification

info

Before creating a DAC template, please ensure that at least one PAI certificate based on the Matter specification has been created so that it can be selected and inherited during configuration.

tip

The default mode is simple mode, which requires only basic information. If you need to configure additional fields for the system-generated certificate, you can switch to advanced mode by clicking Advanced Mode in the top-right corner of the page.

1. On the PKI page, expand the corresponding certificate chain, and then click the Options icon for the corresponding PAI certificate and select Add.

   

2. On the Basic Info section, select and enter the basic information.

   

   Description of DAC template basic information:

   Information	Description
   Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
   Environment	The environment is inherited from the PAI certificate.
   Issuer	The inherited PAI certificate.
   Specification	Default is Matter.
   Level Name	Default is DAC.
   Validity Period	Set the validity period of the DAC template. Setting an expiration date beyond that of the inherited certificate may result in certificate chain validation failures, client trust issues, and audit risks.
   Matter VID	Matter vendor ID.
   Matter PID	Matter product ID.
   Notes	Provide additional information related to the DAC template, such as special requirements and important notes.

   The configuration of advanced mode

   The configuration of advanced mode

   

   • Description of Basic information:

     Information	Description
     Version	The standard version and can't be modified.
     Algorithm	Automatically parsed from the certificate content and can't be modified.
     Signature Algorithm	Automatically parsed from the certificate content and can't be modified.

   • Description of Subject DN information:

     Information	Description
     Common Name	Name of certificate holder.
     Organization (O)	Organizational name.
     Organizational Unit (OU)	Organizational unit name.
     Country	Two ISO country codes.
     State / Province	State or province name.
     Locality (L)	City name.
     Email	User email.
     Matter VID	Matter vendor ID.

   • Description of Extensions information:

     tip

     If the Critical checkbox for a certain item is selected, the system must recognize and support that item when processing the certificate; otherwise, the certificate will be rejected.

     Information	Description
     Basic Constraints	Confirm if it is a CA certificate.
     Key Usage	Automatically parsed from the certificate content and can't be modified.
     Extended Key Usage (EKU)	Optional extended key usages, such as Server Auth, Client Auth, and Code Signing.

3. After verifying that the information is correct, click Create to complete the DAC template creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.