I have a use case, the IoT system sending a signed file to the data center and I have an internal CA to read the corresponding public key to verify the signature on the signed file.

I am not sure how the flow work functions if I am sending a signed file from the data center to IoT. Does the CA help to sign the files? And I don't want to read the private key out from a HSM to sign the file--isn't that correct?

Can someone please help with how I could send the signed files from the client to server and server to the client?

To make it a bit more complex, I want to sign and encrypt as well. My requirement is to store the private key on a HSM (server-side) on TPM (IoT).

  • 2
    $\begingroup$ I'm not entirely sure what you're asking. A CA signs a certificate. $\endgroup$ – forest Jul 18 '19 at 2:20
  • $\begingroup$ Yes, CA signs CSR and issues the Digital cert. If I want to use PKI (CA) for sending signed files back and forth between client and server, How does it work? Issuing CA Private key is on HSM. $\endgroup$ – yls Jul 18 '19 at 2:23
  • $\begingroup$ The CA stops being involved once the certificates are created. The files are signed by a private key, and then verified by a public key. You trust the public key if it has a certificate signed by the CA that you trust. $\endgroup$ – Jack Schmidt Jul 18 '19 at 2:26
  • $\begingroup$ Thank Jack. I agree with you from IoT to the Datacenter use case. But how would I achieve this from the server to IoT? If I generate keypairs on the servers side and send signed cert to the IoT for it to verify but I am not really securing the private key in the secure storage. my requirement is to store the private key in HSM. $\endgroup$ – yls Jul 18 '19 at 2:27
  • $\begingroup$ Is the issue how to send the TPM-held key to the certificate authority for signing? $\endgroup$ – Jack Schmidt Jul 18 '19 at 2:45

Browse other questions tagged or ask your own question.