Rotate Certificates

Manage the certificates of your edge device by creating new ones and revoking old ones.

A certificate/key pair is used in MQTT mTLS connections to the TilliT IoT Cloud. It's important that the keys for this connection are kept safe and secure. For this reason, all certificate/key pairs can only be downloaded once at the time of creation. If you lose your certificate, or you would like to swap out the certificates for your connection, you can use the Manage Certificates screen to achieve this.

Create a new Certificate

Open an edge, and navigate to the Manage Certificates screen by using the Actions button

On the following screen you will see existing certificates for the edge. To create a new one, click on Create Certificate

After the request to create completes, your browser will automatically download the created certificate. Be sure to save it

You will also see the new certificate in the list. This list is always ordered by oldest first, and the name of the ID of the certificate is also located on the .zip file

Remove the old Certificate

A maximum of two certificates can be associated to an edge. This allows for a new certificate to be created and then swapped out with the old one. Once this has been completed, the old certificate should be removed.

When multiple certificates are listed, a red cross will be visible to choose a certificate to remove. Click the the red cross to remove the appropriate certificate.

A confirmation dialog will appear. Click Delete to confirm the action

Now, the list of certificates shows only one certificate.

OPC-UA Self-Signed Certificate Rotation

OPC-UA connections use a self-signed client certificate with a 5-year validity period. When this certificate approaches expiry, it must be rotated without interrupting the OPC-UA connection.

TilliT Edge automatically detects when the active OPC-UA client certificate is within the expiry warning window (configured via OPCUA_CERT_WARN_DAYS). When detected, the edge generates a new pending self-signed certificate and private key ahead of time.

Rotation Process

1. The edge detects that the active OPC-UA client certificate is nearing expiry.

2. A new pending certificate is generated automatically.

3. The thumbprint of the pending certificate must be approved in the OPC-UA server's quarantine before the active certificate lapses.

4. Once approved, the edge activates the new certificate, completing the rotation with zero downtime.

The pending certificate must be approved in the OPC-UA server quarantine before the active certificate expires. Plan ahead to allow time for the approval process.