How to create a certificate based on the Matter specification in OnBoard™ IoT Security

This article will guide you on how to create a certificate based on the Matter specification in OnBoard™ IoT Security (OBIS).

Prerequisites

Before getting started, please ensure that you have OBIS role permissions as a System Manager or Resource Manager.

Instructions

tip

After a certificate template based on the Matter specification is created, it can be selected when configuring Certificates for a product.

1. Sign in to OBIS.

2. In the Core section of the left menu, click PKI, and then click Create on the PKI page.

   

Create a PAA certificate based on the Matter specification

1. On the Basic Info section, select Use Snowball PAA or Import Your Own PAA as needed.

   tip

   If a system-generated PAA certificate already exists in the current environment, select Import Your Own PAA to create a new PAA.

   

   Description of PAA certificate basic information:

   Information	Use Snowball PAA	Import Your Own PAA
   Name	The PAA certificate name must be unique in the same environment.
   Environment	Two environments can be selected: PROD and TEST.
   Specification	Select the Matter specification.
   Level Name	Default is PAA.
   Generation Method	No file upload is required.	Click the Add icon to select and upload a PAA certificate in .pem format, or directly drag your own PAA certificate into the upload area.
   Common Name	Name of certificate holder.	N/A
   Notes	Provide additional information related to the PAA certificate, such as special requirements and important notes.

2. After verifying that the information is correct, click Create to complete the PAA certificate creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

Create a PAI certificate based on the Matter specification

info

Before creating a PAI certificate based on the Matter specification, please ensure that at least one PAA certificate based on the Matter specification has been created so that it can be selected and inherited during configuration.

1. On the PKI page, click the Options icon for the corresponding PAA certificate and select Add PAI.

   

2. On the Basic Info section, select and enter the basic information.

   • If the issuer of the PAI certificate is your own PAA certificate, you can select Generate by System or Bring Your Own Certificate as needed

     

     Information	Generate by System	Bring Your Own Certificate
     Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
     Environment	The environment is inherited from the PAA certificate.
     Issuer	The inherited PAA certificate.
     Specification	Default is Matter.
     Level Name	Default is PAI.
     Generation Method	No file upload is required.	Click the Add icon to select and upload a PAI certificate in .pem format, or directly drag your own PAI certificate into the upload area.
     Common Name	Name of certificate holder.	N/A
     Matter VID	Matter vendor ID.	N/A
     Matter PID	Matter product ID.	N/A
     Notes	Provide additional information related to the PAI certificate, such as special requirements and important notes.

   • If the issuer of the PAI certificate is the system-generated PAA certificate

     

     Information	Description
     Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
     Environment	The environment is inherited from the PAA certificate.
     Issuer	The inherited PAA certificate.
     Specification	Default is Matter.
     Level Name	Default is PAI.
     Validity Period	You can choose Duration, Specific Date, or Never Expires to set the validity period as needed. Setting an expiration date beyond that of the inherited certificate may result in certificate chain validation failures, client trust issues, and audit risks.
     Common Name	Name of certificate holder.
     Matter VID	Matter vendor ID.
     Matter PID	Matter product ID.
     Notes	Provide additional information related to the PAI certificate, such as special requirements and important notes.

3. After verifying that the information is correct, click Create to complete the PAI certificate creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.

   When creating a PAI certificate, if the issuer is your own PAA certificate, you must complete the CSR (Certificate Signing Request) configuration for the PAI certificate. Before the CSR configuration is completed, the certificate will remain in the Pending status and can't be used.

CSR configuration steps for the PAI certificate

tip

When creating a PAI certificate, if the issuer is your own PAA certificate, refer to the following steps to complete the CSR configuration.

1. On the PKI page, expand the corresponding certificate chain, and then click the corresponding PAI certificate.

2. Locate the Download CSR (Certificate Signing Request) section on the certificate page, click Download to download the CSR file. Then, use your Root CA to sign the file, thereby generate a PAI certificate signed by the Root CA.

   

3. After a PAI certificate is generated, click the Add icon in the upload area, select and upload the PAI certificate in .pem format (the maximum supported file size is 512 MB), or directly drag and drop your PAI certificate into the upload area.

4. Click Submit. Once the configuration is completed, the PAI certificate status will change to Normal.

Create a DAC template based on the Matter specification

info

Before creating a DAC template, please ensure that at least one PAI certificate based on the Matter specification has been created so that it can be selected and inherited during configuration.

1. On the PKI page, expand the corresponding certificate chain, and then click the Options icon for the corresponding PAI certificate and select Add DAC Template.

   

2. On the Basic Info section, select and enter the basic information.

   

   Description of DAC template basic information:

   Information	Description
   Name	Within the same certificate chain, certificate names at the same hierarchy level must be unique.
   Environment	The environment is inherited from the PAI certificate.
   Issuer	The inherited PAI certificate.
   Specification	Default is Matter.
   Level Name	Default is DAC.
   Validity Period	Set the validity period of the DAC template. Setting an expiration date beyond that of the inherited certificate may result in certificate chain validation failures, client trust issues, and audit risks.
   Matter VID	Matter vendor ID.
   Matter PID	Matter product ID.
   Notes	Provide additional information related to the DAC template, such as special requirements and important notes.

3. After verifying that the information is correct, click Create to complete the DAC template creation.

   tip

   By default, the certificate creator is set as the Admin. To change the Admin, click the Options icon for the Admin and select Transfer Admin on the Member tab, then choose the new Admin and click Confirm.