I have a use case, the IoT system sending a signed file to the data center and I have an internal CA to read the corresponding public key to verify the signature on the signed file.

I am not sure how the flow work functions if I am sending a signed file from the data center to IoT. Does the CA help to sign the files? And I don't want to read the private key out from a HSM to sign the file--isn't that correct?

Can someone please help with how I could send the signed files from the client to server and server to the client?

To make it a bit more complex, I want to sign and encrypt as well. My requirement is to store the private key on a HSM (server-side) on TPM (IoT).


closed as unclear what you're asking by Maarten Bodewes Jul 27 at 20:18

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    $\begingroup$ I'm not entirely sure what you're asking. A CA signs a certificate. $\endgroup$ – forest Jul 18 at 2:20
  • $\begingroup$ Yes, CA signs CSR and issues the Digital cert. If I want to use PKI (CA) for sending signed files back and forth between client and server, How does it work? Issuing CA Private key is on HSM. $\endgroup$ – yls Jul 18 at 2:23
  • $\begingroup$ The CA stops being involved once the certificates are created. The files are signed by a private key, and then verified by a public key. You trust the public key if it has a certificate signed by the CA that you trust. $\endgroup$ – Jack Schmidt Jul 18 at 2:26
  • $\begingroup$ Thank Jack. I agree with you from IoT to the Datacenter use case. But how would I achieve this from the server to IoT? If I generate keypairs on the servers side and send signed cert to the IoT for it to verify but I am not really securing the private key in the secure storage. my requirement is to store the private key in HSM. $\endgroup$ – yls Jul 18 at 2:27
  • $\begingroup$ Is the issue how to send the TPM-held key to the certificate authority for signing? $\endgroup$ – Jack Schmidt Jul 18 at 2:45

Browse other questions tagged or ask your own question.