Licensed devices are routers, gateways and controllers made to work with Hermetry. They speak the platform’s device protocol from the factory, so they need no setup beyond claiming. This page explains what a licensed device gives you compared with a device you connect yourself, and where each feature is documented.
At a glance
| Feature | Licensed device | Your own MQTT device |
|---|---|---|
| How it joins your organisation | Claimed with the code on its local Cloud page | New device, import or self-provisioning |
| Login | X.509 certificate from the Hermetry device CA, renewed by itself | Access token or MQTT basic (your choice) |
| Profile | A copy of its model’s profile, made from a platform template | A profile you create |
| Self-description | Reports model, hardware, firmware and capabilities when it connects | Whatever attributes you send |
| Remote settings | Every setting of the model, per device or in bulk | cfg.* configuration keys |
| Firmware updates | Built in, with local approval, metered-link and data-quota rules | If your firmware supports the fw_* protocol |
| Remote access to its web panel | Routers: from the device page, without a fixed IP | — |
| LoRaWAN gateway | Routers with a LoRa radio | Basics Station gateways |
| Gateway for field devices | Depending on the model | If your software implements v1/gw/* |
| Ownership and release | Ownership tab, release back to the factory pool | Delete |
Factory identity
Each licensed device leaves the factory with a serial number, a device certificate whose private key never leaves the device, and a claim secret. Before it is claimed it belongs to no organisation: it can reach Hermetry, but its data is dropped.
Note
There is no printed claim label. The QR code and claim code are shown only on the device’s local panel, behind its login.
Claiming and releasing
You claim a device by opening its claim window on its local Cloud page and entering its serial and code (or scanning its QR) under Devices > New device. The device is added with its model’s profile and its certificate, and connects within seconds. See Adding and claiming devices.
Its Ownership tab shows the serial, model, certificate validity and when it was added. Release device returns it to the factory pool so another owner can claim it; a local factory reset does not release it. A device can also be released with the Release button on its own Cloud page; your administrators are then told.
Security details: Device identity and claiming security.
Certificates
A licensed device logs in with its X.509 certificate (ECDSA P-256), renews it before it expires, and can be asked to renew with the cert.renew command. If it asks for a new certificate while the current one is still valid (for example after a repair), you approve the request. See Device certificates.
Its profile accepts X.509 certificates only, and its downlink messages are limited to 4 KiB.
Self-description
When it connects, a licensed device reports its model, type, hardware, board, firmware version, protocol version and capabilities. The device page shows them (Firmware, Protocol), and Hermetry uses them to offer the right settings, firmware and features.
Remote settings
Every setting of the model is shown on the device’s Settings tab, and can be changed for many devices at once with baselines and bulk jobs under Bulk settings. Changes are applied by the device and confirmed; a change that would cut the device off is undone by the device itself when it cannot reach the cloud again. See Remote device settings.
Firmware
Licensed devices take updates through Firmware. Two rules come from the device itself:
- Local approval. A router can be set to ask before it installs an update. The update then waits (“Waiting for approval on the device”) until someone approves it on the router’s own Cloud page. That setting is changed on the router, not in Hermetry.
- Metered links and data quota. On a mobile (metered) link, the device waits for another link unless Allow updates over LTE (mobile data) is on for it or its profile. An update never starts while the device’s mobile data quota is used up.
Commands
Licensed devices understand the platform’s standard commands, for example sys.info, sys.ping, sys.reboot, cert.renew and ota.check. The commands you can send, and their tiers, are listed on the profile’s Commands tab. A factory reset is never sent remotely. See Sending commands to devices.
Remote access to a router’s panel
Administrators can open a claimed router’s web panel in the browser from the device page, without a fixed IP and without opening ports: the router dials out to Hermetry. Sessions are limited (at most 3 per router, 4 hours each and 30 minutes idle), and on a metered uplink you confirm first and a 50 MB cap applies. Every session is audited. See Remote access to a router’s panel and Remote access limits and audit.
LoRaWAN and field devices
- A licensed router with a LoRa radio can be your LoRaWAN gateway, connected over its own secure link with its certificate (no token). See Licensed routers as LoRaWAN gateways.
- Licensed gateways can read field devices (for example over RS485 or Modbus, depending on the model) and report them as child devices, and buffer readings while the link is down. See Licensed gateways and Hermetry Edge.
In development
- eSIM management (adding, switching and removing operator profiles on a router’s eSIM from Hermetry) is in development. Today a licensed router works with the SIM card and operator you choose. See Cellular connections and eSIM.
- Commands to devices behind a gateway are in development.
- The Hermetry mobile app is in development.
See In development.