Products /
CertManager
Simple certificate infrastructure for IoT device fleets.
Connected devices need identities.
If a device communicates with another device, an application or a service, the other party needs a way to establish that it is communicating with the intended device — and not simply with somebody who happens to know a shared secret.
ControlThings CertManager is a lightweight certificate management system for issuing X.509 certificates to IoT devices and maintaining an overview of the device fleet.
It provides the certificate infrastructure needed to give connected devices cryptographic identities, and to keep those identities under control throughout their lifetime.
Why not just use API keys?
API keys are a simple and useful way of authenticating software clients. But they are fundamentally shared secrets.
If an API key is copied, whoever obtains the key can generally use it as the identity of the original client. The system has no cryptographic way to distinguish the legitimate device from a copy of its secret.
A cryptographic identity works differently.
A device has a private cryptographic key which does not need to be disclosed to anyone else. The corresponding public key can be used to verify digital signatures produced by the device.
This makes it possible to establish:
“This particular device, possessing this private key, performed this operation.”
rather than merely:
“Someone possessing this API key made this request.”
This distinction becomes particularly important when devices interact with other devices or organisations. Cryptographic identities allow the participants to authenticate each other and to produce evidence that can subsequently be verified.
For autonomous and distributed systems, this provides an important foundation for trustworthy event histories and verifiable audit trails.
What is an X.509 certificate?
The cryptographic key itself is not necessarily enough.
A public key needs an identity and a context: whose key is this, and who is willing to vouch for it?
An X.509 certificate provides that association.
In simplified terms, a certificate is a digitally signed statement that associates a public cryptographic key with an identity and other information about its intended use. The signature is made by a Certificate Authority (CA), allowing another party to verify that the certificate was issued by an authority it trusts.
The private key remains with the device. The certificate can be distributed to the parties that need to authenticate the device.
This gives us a useful division of responsibility:
PRIVATE KEY
│
│ stays with the device
▼
DEVICE CRYPTOGRAPHIC IDENTITY
│
│ represented / vouched for by
▼
X.509 CERTIFICATE
│
│ issued by
▼
CERTIFICATE AUTHORITY
X.509 is a well-established standard and is widely supported by TLS and other security software. It therefore provides a practical foundation for mutual authentication between IoT devices, applications and services.
Why certificate management is necessary
Issuing one certificate is relatively easy.
Managing a fleet of devices is not.
A real IoT deployment may contain hundreds, thousands or millions of devices. Each device may have its own private key and certificate, and certificates have a lifecycle:
PROVISION
│
▼
ACTIVATE
│
▼
USE
│
┌─────┴─────┐
│ │
▼ ▼
ROTATE REVOKE
│ │
└─────┬─────┘
▼
REPLACE
Certificates may need to be issued when a device is manufactured or activated. They may need to be renewed or rotated during the device’s lifetime. A compromised, retired or decommissioned device may need to have its certificate revoked.
At the same time, the operator needs to know which devices exist, which certificates they possess, and which devices are currently activated.
Without certificate management, these tasks tend to become a collection of scripts, database records and manual procedures — precisely the kind of infrastructure that becomes difficult to operate reliably as a fleet grows.
Certificate management is therefore not merely about creating certificates. It is about maintaining the cryptographic identities of an entire device fleet throughout their lifecycle.
CertManager
CertManager provides a central, straightforward way to perform these operations.
The system provides a simple API for certificate operations and a web interface for viewing and managing devices.
X.509 certificates
Issue cryptographic identities for connected devices through a straightforward API.
Device fleet
Maintain a central view of devices and their associated certificates.
Multi-tenant architecture
Organise independent device fleets within the same service.
Deploy anywhere
CertManager is containerized and can be deployed in cloud or on-premises environments.
Certificate infrastructure for autonomous devices
Certificate management becomes particularly useful when devices do more than simply connect to a central cloud service.
Consider two autonomous devices belonging to different parties. If they interact, each device needs a way to establish the identity of the other.
With cryptographic identities, the devices can authenticate one another without relying on a shared secret.
This also creates a foundation for verifiable event histories.
An autonomous device can sign evidence of an event with its private key. Another participating device can retain and verify that evidence. The resulting chain of events can involve many independent actors rather than being merely a log controlled by the owner of one device.
This is important because the owner of an autonomous device may have complete technical control over its own logging infrastructure. A log maintained solely by that owner is therefore not necessarily sufficient evidence to another party.
Cryptographically signed events provide a different trust model:
The participants can obtain evidence from each other that can subsequently be verified, rather than having to trust each other’s private logs.
CertManager provides part of the infrastructure needed for this model by making cryptographic identities practical to provision and maintain.
The audit trail itself is the higher-level application: it uses those identities to establish who participated in an event and to build a history whose integrity can be verified.
A simple foundation
CertManager is deliberately straightforward.
It is a lightweight certificate management system built around X.509 and OpenSSL, with a web interface and APIs for system integration. It can run as a Docker application on cloud infrastructure or on-premises.
The purpose is not to replace the underlying cryptographic standards. Rather, CertManager puts the operational machinery around them:
issue identities → manage devices → maintain certificates → support authenticated communication → enable trustworthy evidence.
That makes certificate infrastructure practical for IoT projects without requiring every application team to build and maintain its own Certificate Authority tooling.
Under the hood
CertManager is built around a web application backend based on the OpenSSL framework, with a modern user interface and APIs for system integration.
It can run as a Docker application on any cloud environment or on-premises.
The system is designed to provide the practical infrastructure around standard cryptographic components rather than introducing a proprietary cryptographic scheme.
Relationship to Verifiable Event Logging
Cryptographic identity and certificate management are supporting technologies for a broader problem: how can autonomous and distributed systems produce evidence that can be trusted after the event?
A certificate can establish the identity associated with a public key.
A digital signature can establish that the holder of the corresponding private key participated in an operation.
A verifiable audit trail can then connect such signed events into a history involving multiple independent actors.
Conceptually:
CRYPTOGRAPHIC IDENTITY
│
▼
X.509 CERTIFICATE
│
▼
MUTUAL AUTHENTICATION
│
▼
SIGNED ACTION
│
▼
VERIFIED EVENT
│
▼
IMMUTABLE EVENT CHAIN
│
▼
VERIFIABLE AUDIT TRAIL
CertManager addresses the identity and certificate-management layer.
The Verifiable Event Logging technology addresses what happens afterwards: making the resulting history trustworthy and independently verifiable.
In brief
CertManager provides simple certificate infrastructure for IoT device fleets.
It makes it practical to issue and manage X.509 certificates, maintain an overview of device identities, and integrate certificate operations into connected-device applications.
The deeper purpose is to provide a trustworthy identity layer for connected actors — one that can support mutual authentication today and verifiable evidence of their actions tomorrow.