| ID | device-lifecycle.provisioning |
|---|---|
| Description | A new device proves its identity, receives a signed certificate and becomes an active, managed device. |
| Key | provisioning |
| Type | Sequence Workflow Diagram |
| Tags | device security |
Provisioning is the device’s first contact with the platform. It turns a factory-fresh unit holding only a bootstrap credential into a fully managed device with its own operational certificate and an initialised twin.
Zero-touch by design
No human configures the device. It connects, proves a provisioning claim, and is issued a unique operational certificate — so the bootstrap credential is never used for day-to-day traffic.
| Number | Source | Destination | Description |
|---|---|---|---|
| 1 | Device | MQTT broker | Connect with bootstrap credential |
| 2 | MQTT broker | Device registry | Validate provisioning claim |
| 3 | Device registry | CA service | Request signed certificate (CSR) |
| 4 | CA service | Device registry | Operational certificate |
| 5 | Device registry | Twin store | Initialise desired/reported state |
| 6 | Device registry | Device | Certificate + initial config |
| 7 | Device | MQTT broker | Reconnect with operational certificate |
| 8 | MQTT broker | Device registry | Session established (active) |
The device connects to the MQTT Broker using a limited bootstrap credential.
The Device Registry verifies the provisioning claim against the expected fleet.
The registry forwards the CSR to the CA Service, which returns a signed, device-specific certificate.
The twin is seeded with default desired state; the device reconnects using its
new operational certificate and is marked active.