Foundries.io Pregenerated Certificates for Factory Programming

This guide explains how to use pregenerated certificates for Foundries.io images in factory settings to speed up manufacturing test and device onboarding processes.

Overview

By establishing your own Public Key Infrastructure (PKI) and generating device certificates during manufacturing, you can:

• Eliminate the need for devices to access api.foundries.io during manufacturing
• Pre-provision devices with valid certificates before deployment
• Enable automatic device registration upon first boot
• Significantly reduce manufacturing test and onboarding time

Manufacturing Time Savings

See TIMING_ANALYSIS.md for detailed timing breakdown and optimization analysis.

Quick Summary (based on actual measured times):

• Current total time: 10-13.5 minutes per device
  • Flash: 5 minutes
  • Boot (until yellow LEDs): 2-5 minutes
  • Registration: 30-120 seconds
  • Testing: 2 minutes
• With pregenerated certificates: 9.5-13 minutes per device
  • Registration eliminated (saves 25-115 seconds)
• Time saved: 25-115 seconds per device
• At scale: Save 1.67-2.5 hours per 100 devices

Use ./calculate-savings.sh to calculate time and cost savings for your batch sizes.

Prerequisites

• Access to a FoundriesFactory
• fioctl tool installed and configured
• Factory API token (OSF-Token)
• Secure storage for private keys (preferably PKCS#11 compatible HSM)

Step-by-Step Process

1. Set Up Your Factory PKI

Create Root Certificate Authority

Generate your Factory's root CA using fioctl:

fioctl keys ca create /absolute/path/to/certs/

This command generates:

• factory_ca.pem - Root certificate (trust anchor)
• factory_ca.key - Root private key (store securely!)

Security Note: The root CA private key is critical. Store it securely, preferably using a PKCS#11 compatible Hardware Security Module (HSM).

Create Device Certificate Authority

You'll need to create intermediate CAs for device authentication. Foundries.io supports two types:

• Online CA: Managed by Foundries.io, used for devices registering via lmp-device-register
• Local CA: Managed by you, allows certificate generation during manufacturing without internet access

To add a Local Device CA:

fioctl keys ca add-device-ca /absolute/path/to/certs/ --local-ca

This generates a local CA certificate and private key, signed by your root CA.

2. Generate Device Certificates During Manufacturing

With your Local CA in place, you can generate client certificates for each device during the manufacturing process:

1. Use your Local CA to sign client certificates for each device
2. Each device should have a unique certificate
3. Store the private keys securely on each device

This approach allows you to provision devices with valid certificates without needing internet connectivity during manufacturing.

3. Upload Certificates to Foundries.io

After generating your certificates, upload them to configure your Factory's PKI:

# Set your factory name and token
export FACTORY="your-factory-name"
export TOKEN="your-osf-token"

# Prepare certificates (escape newlines for JSON)
ROOT_CA_CRT=$(cat factory_ca.pem | awk -v ORS='\\n' '1')
DEVICE_CA_CRT=$(cat device_ca_list.pem | awk -v ORS='\\n' '1')
TLS_CRT=$(cat tls.pem | awk -v ORS='\\n' '1')

# Upload to Foundries.io API
curl "https://api.foundries.io/ota/factories/${FACTORY}/certs/" \
     -s -X PATCH \
     -H "Content-Type: application/json" \
     -H "OSF-Token: $TOKEN" \
     -d '{
       "root-crt": "'"${ROOT_CA_CRT}"'",
       "tls-crt": "'"${TLS_CRT}"'",
       "ca-crt": "'"${DEVICE_CA_CRT}"'"
     }'

4. Embed Certificates into Device Images

During the manufacturing process:

1. Embed certificates: Integrate the pre-generated client certificates into your device images
2. Store private keys securely: Ensure device private keys are stored in secure storage (e.g., TPM, secure element)
3. Configure auto-registration: Set up devices to use these certificates for automatic registration upon first boot

5. (Optional) Deploy Factory Registration Reference Server

For enhanced control, you can deploy a Factory Registration Reference server within your manufacturing environment:

• Handles device authentication and registration locally
• Can be customized to fit your specific manufacturing requirements
• Allows devices to obtain valid client certificates without internet connectivity

This is particularly useful for air-gapped manufacturing environments.

Benefits

• Faster Manufacturing: No need for devices to access Foundries.io during production
• Offline Capable: Can provision devices without internet connectivity
• Enhanced Security: Full control over your PKI and certificate lifecycle
• Streamlined Onboarding: Devices can authenticate immediately upon deployment
• Production Ready: Devices are ready to connect and operate without additional manual steps

Security Best Practices

1. Secure Key Storage: Use HSMs or secure elements for storing root CA private keys
2. Certificate Rotation: Regularly rotate certificates and keys as needed
3. Access Control: Limit access to CA private keys to authorized personnel only
4. Audit Logging: Maintain logs of certificate generation and device provisioning
5. Secure Manufacturing: Ensure secure handling of certificates during manufacturing

References

For complete official documentation, see OFFICIAL_DOCS.md which contains all Foundries.io documentation links.

Key Official Documentation:

• Foundries.io Device Gateway PKI Documentation - Comprehensive reference manual
• Factory Registration Reference Implementation - Manufacturing process guide
• Device Gateway PKI User Guide - Step-by-step user guide
• Foundries.io Blog: Device Gateway PKI - Overview and benefits

Next Steps

1. Set up your Factory PKI using fioctl
2. Generate test certificates for a few devices
3. Integrate certificate generation into your manufacturing workflow
4. Test the end-to-end process with a small batch of devices
5. Scale to full production once validated