Three things from 2.2.2 on the security side. Firmware rollouts and the gateway API are in the same release; my colleagues are posting about those separately.
Device certificates now have screens: a Certificates page for the organisation and a Certificate tab on each device. Licensed devices log in with an X.509 client certificate from Hermetry’s device CA. The device makes its own key pair and the private key never leaves it; the certificate’s common name is the device serial. The default lifetime is 365 days (30 to 825, set on the device profile), and devices renew at the latest 30 days before expiry. Administrators are told about certificates that are close to expiry and not renewed, and those renewal notices now arrive in your language.
AI firewall: a gateway’s created and refused child devices now count as signals about that gateway. The firewall scores every actor against its own normal behaviour, so a gateway that suddenly creates or gets refused children raises its own score, and an incident opens when the score is high enough.
One smaller change I like: devices whose profile says they do not log in no longer get an access credential they would never use. A credential nobody uses is still a credential somebody could steal.
Docs: Device certificates, The device certificate authority, The AI firewall.
We build our own boards around an ESP32-S3 and already do mutual TLS with our own CA on another project. Can we upload that CA so our devices use the certificate path too?
No. Uploading your own CA for third-party X.509 devices isn’t available; third-party devices use access tokens or MQTT basic. The certificate path is for licensed devices, whose certificates come from Hermetry’s CA at provisioning.
How fast is revocation in practice? If I revoke a cert, does the device stay connected until it reconnects?
It’s disconnected at once. Revoke certificate asks for a reason (Key compromise, Superseded, Device retired or Unspecified) and for the device serial as confirmation. The fingerprint goes into the revocation set of every gateway node, the live connection is dropped, and the next login attempt gets CONNACK 5. It’s also listed in the next CRL; each issuing CA’s list is valid for 7 days.
It can’t be undone. The device needs a new certificate before it connects again.
On the gateway signals: does the firewall act on the gateway by itself, or only flag it? I don’t want a false positive taking a whole line of Modbus children offline at 3 am.
Every firewall action starts in Observe unless you choose otherwise, and actions on devices start in Suggest, so a proposal waits for an administrator. Revoking a device’s credential, ending its connection and revoking its certificate are Suggest-only: a person approves every run. Disabling a device runs on its own only if you set that action to Auto yourself.
- You must be logged in to reply to this topic.
Join the conversation
Sign in to ask and answer, like helpful posts and mark the reply that solved your problem. Every contribution earns points and levels.