Cryptographic Posture Management — discover, grade & remediate your whole cryptographic estate
Sovereign Certificate Authority for enterprise-grade certificate issuance & management
Certificate Lifecycle Management, discovery, governance & automation
DNS-agnostic Domain Control Validation, ready for 47-day TLS certificates
Base stations, EV chargers, smart meters and industrial controllers do not fill in web forms — they enroll, renew and revoke through protocols burned in at the factory. This guide explains why operational-technology fleets break IT-style PKI, which enrollment protocols they actually speak (CMPv2, EST, SCEP), and how to run a factory-to-field certificate lifecycle at fleet scale without truck rolls.
Operational technology (OT) PKI is certificate lifecycle management for machines rather than people. The devices — base stations, EV chargers, smart meters, PLCs and industrial gateways — do not use browsers or portals; they carry an enrollment client installed at manufacturing time and expect the certificate authority to speak their protocol: CMPv2, EST or SCEP.
These fleets break the assumptions IT PKI is built on. They outlive algorithm deprecations and vendor lifetimes, they choose the protocol, they enroll machine-to-machine at scales of tens or hundreds of thousands, and they often live on segmented or air-gapped networks under NIS2 and IEC 62443. This guide covers what those constraints mean in practice and how a device certificate lifecycle runs from factory bootstrap to in-field renewal to decommission.
A public key infrastructure designed for laptops, servers and human users runs into a wall the first time it meets a fleet of industrial devices. The device does not open a browser, cannot be handed a one-time password by a helpdesk, and will not be re-flashed to suit the certificate authority. It ships from the factory already knowing how it wants to enroll, and the PKI has to meet it on those terms.
This guide is about PKI that speaks machine: why operational-technology fleets break IT-style certificate management, which enrollment protocols they actually use, and how a single certificate lifecycle spans a device from the factory floor to years of unattended field operation.
The gap is not a matter of scale alone. Industrial and OT devices violate four assumptions that IT PKI quietly depends on, and each one has to be designed for rather than worked around.
An industrial device deployed today will still run in 2040 — past algorithm deprecations, past vendor lifetimes, past the post-quantum deadlines. Its identity plumbing has to survive all of it, which makes crypto-agility a fleet requirement, not a nicety.
OT equipment ships with its enrollment client factory-installed: CMPv2, EST or SCEP. The PKI adapts to the device; nobody re-flashes ten thousand chargers to please the CA.
Enrollment happens machine-to-machine, over constrained links, at fleet scale. Portals and manual approval loops are not an option at 100,000 devices.
Industrial networks are segmented, often air-gapped, and regulated under NIS2, IEC 62443 and the Cyber Resilience Act. Identity infrastructure must run on premises, under the operator's control.
There is no single "IoT enrollment protocol". A real estate mixes embedded devices that speak industrial protocols with servers and gateways that speak the IT ones, and the PKI has to answer all of them.
RFC 4210 covers the full lifecycle in one protocol: initial enrollment, PKCS#10 certification requests, in-field key update, revocation and confirmations. It supports both authentication models devices actually use — shared secret (password-based MAC) for first contact, or signature with the certificate the device already holds — and Registration Authority forwarding, so an on-site RA can batch requests and forward them under a single signature. The Lightweight CMP Profile (RFC 9483) tightens it for modern deployments.
EST (RFC 7030) runs enrollment over TLS with optional server-side key generation. EST-coaps (RFC 9148) carries the same enrollment over DTLS and CoAP, sized for the most constrained, battery- and bandwidth-limited devices.
The value of a machine-oriented PKI shows up over the life of the device, not just at first enrollment. The same certificate lifecycle should carry a device from the assembly line to the day it is decommissioned, with no site visit in between.
Devices enroll with a factory credential or shared secret, following the vendor-certificate patterns the telecom world standardised (3GPP TS 33.310). Open enrollment can be gated by validation rules instead of per-device pre-registration.
A device signs its key update with the certificate it already holds; the platform verifies it, issues the new certificate, and supersedes the old one. No operator, no downtime, no site visit.
Sites with a local RA forward batched requests under a single RA signature — thousands of devices behind one trusted channel.
Every enrollment, renewal and revocation is an audited lifecycle event, attributable per device, per profile, per site.
Speaking the protocols is necessary but not sufficient. The fleet also has to be governed like any other part of the certificate estate — discovered, graded, policy-bound — and anchored to a certificate authority the operator actually controls.
A device-ready certificate lifecycle manager keeps one inventory for every device certificate, discovered and graded alongside the rest of the estate, with profiles that enforce per-fleet policy (key types, validity, subject rules, who may renew or revoke) and triggers that wire lifecycle events into the SOC and ticketing. Behind it, a sovereign CA stack — CA, OCSP, timestamping — runs on premises, air-gap friendly, with keys in the operator's HSMs, aligned with NIS2, IEC 62443 and Cyber Resilience Act expectations.
The post-quantum angle is not optional here: devices deployed today will outlive the 2030/2035 migration deadlines, so their trust chain has to be able to migrate to hybrid and post-quantum algorithms without re-architecting the fleet. That is the payoff of getting OT PKI right the first time — one root of trust, one lifecycle, and a fleet that can follow the cryptography forward instead of being frozen at the algorithms it shipped with.
