| ID | device-lifecycle.provisioning |
|---|---|
| Description | A new device proves its identity, receives a signed certificate and becomes an active, managed device. |
| Key | provisioning |
| Tags | device security |
Specification
Device provisioning
Provisioning is the device’s first contact with the platform. It turns a factory-fresh unit holding only a bootstrap credential into a fully managed device with its own operational certificate and an initialised twin.
Zero-touch by design
No human configures the device. It connects, proves a provisioning claim, and is issued a unique operational certificate — so the bootstrap credential is never used for day-to-day traffic.
Participants
Device Registry
Validates the claim and creates the device record.
CA Service
Signs the device’s certificate request.
Twin Store
Holds the device’s initial desired/reported state.
Steps
Connect with bootstrap credential
The device connects to the MQTT Broker using a limited bootstrap credential.
Validate the claim
The Device Registry verifies the provisioning claim against the expected fleet.
Issue an operational certificate
The registry forwards the CSR to the CA Service, which returns a signed, device-specific certificate.
Initialise the twin and reconnect
The twin is seeded with default desired state; the device reconnects using its
new operational certificate and is marked active.
Steps
| Number | Source | Destination | Description |
|---|---|---|---|
| 1 | Device | MQTT broker | Connect with bootstrap credential |
| 2 | MQTT broker | Device registry | Validate provisioning claim |
| 3 | Device registry | CA service | Request signed certificate (CSR) |
| 4 | CA service | Device registry | Operational certificate |
| 5 | Device registry | Twin store | Initialise desired/reported state |
| 6 | Device registry | Device | Certificate + initial config |
| 7 | Device | MQTT broker | Reconnect with operational certificate |
| 8 | MQTT broker | Device registry | Session established (active) |