Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

secure provisioning

Giving a device its own key and certificate without the private key being anywhere it shouldn't.

Secure provisioning establishes a device's unique cryptographic identity -- a key pair and a certificate binding it to the device -- such that the private key is never exposed outside the device or a trusted key-generation boundary.

Examples

  • Generating the key pair on the ESP32 with its hardware random number generator and sending out only a CSR keeps the private key from ever leaving the device.

  • Chapter 10's lab made each node's key on a laptop, which secure provisioning avoids: the key existed, for a while, where it shouldn't.

See also

certificate signing request claim certificate device identity
Read the full section →