How to create a certificate based on the Google Cast specification in OnBoard™ IoT Security

This article will guide you on how to create a certificate based on the Google Cast specification in OnBoard™ IoT Security (OBIS).

Prerequisites

Before getting started, please ensure that you have OBIS role permissions as a System Manager or Resource Manager.

Instructions

tip

After a certificate template based on the Google Cast specification is created, it can be selected when configuring Certificates for a product.

1. Sign in to OBIS.

2. In the Core section of the left menu, click PKI, and then click Create on the PKI page.

   

Create a Google Root certificate based on the Google Cast specification

1. On the Basic Info section, enter and select the basic information.

   

   Description of Google Root certificate basic information:

   Information	Description
   Name	The Google Root certificate name must be unique in the same environment.
   Environment	Two environments can be selected: TEST and PROD.
   Specification	Select the Google Cast specification.
   Level Name	Default is Google Root.
   Generation Method	Click the Add icon to select and upload a Google Root certificate in .pem format, or directly drag your own Google Root certificate into the upload area.
   Notes	Provide additional information related to the Google Root certificate, such as special requirements and important notes.

2. After verifying that the information is correct, click Create to complete the Google Root certificate creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

Create a Manufacturer certificate based on the Google Cast specification

info

Before creating a Manufacturer certificate based on the Google Cast specification, please ensure that at least one Google Root certificate based on the Google Cast specification has been created so that it can be selected and inherited during configuration.

tip

The default mode is simple mode, which requires only basic information. If you need to configure additional fields for the system-generated certificate, you can switch to advanced mode by clicking Advanced Mode in the top-right corner of the page.

1. On the PKI page, click the Options icon for the corresponding Google Root certificate and select Add Manufacturer.

   

2. On the Basic Info section, select and enter the basic information. You can select Generate by System or Bring Your Own Certificate as needed

   

   Information	Generate by System	Bring Your Own Certificate
   Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
   Environment	The environment is inherited from the Google Root certificate.
   Issuer	The inherited Google Root certificate.
   Specification	Default is Google Cast.
   Level Name	Default is Manufacturer.
   Generation Method	No file upload is required.	Click the Add icon to select and upload a Manufacturer certificate in .pem format, or directly drag your own Manufacturer certificate into the upload area.
   Common Name	Name of certificate holder.	N/A
   Organization (O)	Organizational name.	N/A
   Organizational Unit (OU)	Organizational unit name.	N/A
   Country	Two ISO country codes.	N/A
   State / Province	State or province name.	N/A
   Locality (L)	City name.	N/A
   Notes	Provide additional information related to the Manufacturer certificate, such as special requirements and important notes.

   The configuration of advanced mode

   The configuration of advanced mode

   

   • Description of Basic information:

     Information	Description
     Version	The standard version and can't be modified.
     Algorithm	Automatically parsed from the certificate content and can't be modified.
     Signature Algorithm	Automatically parsed from the certificate content and can't be modified.

   • Description of Validation Service information:

     Information	Description
     CRL	Automatically parsed from the certificate content, you can set the Full Update Period.

   • Description of Subject DN information:

     tip

     At least one Subject DN information must be provided.

     Information	Description
     Common Name	Name of certificate holder.
     Organization (O)	Organizational name.
     Organizational Unit (OU)	Organizational unit name.
     Country	Two ISO country codes.
     State / Province	State or province name.
     Locality (L)	City name.
     Email	User email.

   • Description of Extensions information:

     tip

     If the Critical checkbox for a certain item is selected, the system must recognize and support that item when processing the certificate; otherwise, the certificate will be rejected.

     Information	Description
     Basic Constraints	Confirm if it is a CA certificate.
     Path Length	Limits the number of sub-certificates.
     Key Usage	Optional key usages, such as Digital Signature, Key Cert Sign, and CRL Sign.
     Extended Key Usage (EKU)	Optional extended key usages, such as Server Auth, Client Auth, and Code Signing.

3. After verifying that the information is correct, click Create to complete the Manufacturer certificate creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

   When creating a Manufacturer certificate issued by an external CA, you must complete the CSR (Certificate Signing Request) configuration for the Manufacturer certificate. Before the CSR configuration is completed, the certificate will remain in the Pending status and can't be used.

CSR configuration steps for the Manufacturer certificate

tip

When creating a Manufacturer certificate, refer to the following steps to complete the CSR configuration.

1. On the PKI page, expand the corresponding certificate chain, and then click the corresponding Manufacturer certificate.

2. Locate the Download CSR (Certificate Signing Request) section on the certificate page, click Download to download the CSR file. Then, use your Root CA to sign the file, thereby generate a Manufacturer certificate signed by the Root CA.

   

3. After a Manufacturer certificate is generated, click the Add icon in the upload area, select and upload the Manufacturer certificate in .pem format (the maximum supported file size is 512 MB), or directly drag and drop your Manufacturer certificate into the upload area.

4. Click Submit. Once the configuration is completed, the Manufacturer certificate status will change to Normal.

Create a Model certificate based on the Google Cast specification

info

Before creating a Model certificate based on the Google Cast specification, please ensure that at least one Manufacturer certificate based on the Google Cast specification has been created so that it can be selected and inherited during configuration.

tip

The default mode is simple mode, which requires only basic information. If you need to configure additional fields for the system-generated certificate, you can switch to advanced mode by clicking Advanced Mode in the top-right corner of the page.

1. On the PKI page, expand the corresponding certificate chain, click the Options icon for the corresponding Manufacturer certificate and select Add Model.

   

2. On the Basic Info section, select and enter the basic information.

   • If the issuer of the Model certificate is your own Manufacturer certificate, you can select Generate by System or Bring Your Own Certificate as needed

     

     Information	Generate by System	Bring Your Own Certificate
     Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
     Environment	The environment is inherited from the Manufacturer certificate.
     Issuer	The inherited Manufacturer certificate.
     Specification	Default is Google Cast.
     Level Name	Default is Model.
     Generation Method	No file upload is required.	Click the Add icon to select and upload a Model certificate in .pem format, or directly drag your own Model certificate into the upload area.
     Common Name	Name of certificate holder.	N/A
     Organization (O)	Organizational name.	N/A
     Organizational Unit (OU)	Organizational unit name.	N/A
     Country	Two ISO country codes.	N/A
     State / Province	State or province name.	N/A
     Locality (L)	City name.	N/A
     Notes	Provide additional information related to the Model certificate, such as special requirements and important notes.

   • If the issuer of the Model certificate the system-generated Manufacturer certificate

     

     Information	Description
     Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
     Environment	The environment is inherited from the Manufacturer certificate.
     Issuer	The inherited Manufacturer certificate.
     Specification	Default is Google Cast.
     Level Name	Default is Model.
     Validity Period	You can choose Duration, Specific Date, or Never Expires to set the validity period as needed. Setting an expiration date beyond that of the inherited certificate may result in certificate chain validation failures, client trust issues, and audit risks.
     Common Name	Name of certificate holder.
     Organization (O)	Organizational name.
     Organizational Unit (OU)	Organizational unit name.
     Country	Two ISO country codes.
     State / Province	State or province name.
     Locality (L)	City name.
     Notes	Provide additional information related to the Model certificate, such as special requirements and important notes.

   The configuration of advanced mode

   The configuration of advanced mode

   

   • Description of Basic information:

     Information	Description
     Version	The standard version and can't be modified.
     Renew	When enabled, certificates can be renewed. The existing public key is retained, and a new certificate is issued with an extended validity period.
     Algorithm	Automatically parsed from the certificate content and can't be modified.
     Signature Algorithm	Automatically parsed from the certificate content and can't be modified.

   • Description of Validation Service information:

     Information	Description
     CRL	Automatically parsed from the certificate content, you can set the Full Update Period.

   • Description of Subject DN information:

     tip

     At least one Subject DN information must be provided.

     Information	Description
     Common Name	Name of certificate holder.
     Organization (O)	Organizational name.
     Organizational Unit (OU)	Organizational unit name.
     Country	Two ISO country codes.
     State / Province	State or province name.
     Locality (L)	City name.
     Email	User email.

   • Description of Extensions information:

     tip

     If the Critical checkbox for a certain item is selected, the system must recognize and support that item when processing the certificate; otherwise, the certificate will be rejected.

     Information	Description
     Basic Constraints	Confirm if it is a CA certificate.
     Path Length	Limits the number of sub-certificates.
     Key Usage	Optional key usages, such as Digital Signature, Key Cert Sign, and CRL Sign.
     Extended Key Usage (EKU)	Optional extended key usages, such as Server Auth, Client Auth, and Code Signing.

3. After verifying that the information is correct, click Create to complete the Model certificate creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

   When creating a Model certificate, if the issuer is your own Manufacturer certificate, you must complete the CSR (Certificate Signing Request) configuration for the Model certificate. Before the CSR configuration is completed, the certificate will remain in the Pending status and can't be used.

CSR configuration steps for the Model certificate

tip

When creating a Model certificate, if the issuer is your own Manufacturer certificate, refer to the following steps to complete the CSR configuration.

1. On the PKI page, expand the corresponding certificate chain, and then click the corresponding Model certificate.

2. Locate the Download CSR (Certificate Signing Request) section on the certificate page, click Download to download the CSR file. Then, use your Root CA to sign the file, thereby generate a Model certificate signed by the Root CA.

   

3. After a Model certificate is generated, click the Add icon in the upload area, select and upload the Model certificate in .pem format (the maximum supported file size is 512 MB), or directly drag and drop your Model certificate into the upload area.

4. Click Submit. Once the configuration is completed, the Model certificate status will change to Normal.

Create a Device template based on the Google Cast specification

info

Before creating a Device template, please ensure that at least one Model certificate based on the Google Cast specification has been created so that it can be selected and inherited during configuration.

tip

The default mode is simple mode, which requires only basic information. If you need to configure additional fields for the system-generated certificate, you can switch to advanced mode by clicking Advanced Mode in the top-right corner of the page.

1. On the PKI page, expand the corresponding certificate chain, then click the Options icon for the corresponding Model certificate and select Add Device Template.

   

2. On the Basic Info section, select and enter the basic information.

   

   Description of Device template basic information:

   Information	Description
   Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
   Environment	The environment is inherited from the Model certificate.
   Issuer	The inherited Model certificate.
   Specification	Default is Google Cast.
   Level Name	Default is Device.
   Validity Period	Set the validity period of the Device template. Setting an expiration date beyond that of the inherited certificate may result in certificate chain validation failures, client trust issues, and audit risks.
   Common Name	Name of certificate holder.
   Organization (O)	Organizational name.
   Organizational Unit (OU)	Organizational unit name.
   Country	Two ISO country codes.
   State / Province	State or province name.
   Locality (L)	City name.
   Notes	Provide additional information related to the Device template, such as special requirements and important notes.

   The configuration of advanced mode

   The configuration of advanced mode

   

   • Description of Basic information:

     Information	Description
     Version	The standard version and can't be modified.
     Algorithm	Automatically parsed from the certificate content and can't be modified.
     Signature Algorithm	Automatically parsed from the certificate content and can't be modified.

   • Description of Subject DN information:

     tip

     At least one Subject DN information must be provided.

     Information	Description
     Common Name	Name of certificate holder.
     Organization (O)	Organizational name.
     Organizational Unit (OU)	Organizational unit name.
     Country	Two ISO country codes.
     State / Province	State or province name.
     Locality (L)	City name.
     Email	User email.

   • Description of Extensions information:

     tip

     If the Critical checkbox for a certain item is selected, the system must recognize and support that item when processing the certificate; otherwise, the certificate will be rejected.

     Information	Description
     Basic Constraints	Confirm if it is a CA certificate.
     Key Usage	Optional key usages, such as Digital Signature.
     Extended Key Usage (EKU)	Optional extended key usages, such as Server Auth, Client Auth, and Code Signing.

3. After verifying that the information is correct, click Create to complete the Device template creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.