Provision a device certificate for remote access¶

Keyword: How do I provision a device certificate for remote access? Part of: Connect a device for remote access—Step 1 of 3

Every device that connects to the SmartTouch Remote Access Service authenticates with an X.509 client certificate. This certificate identifies the device to the session broker and determines which sessions it can accept. This tutorial provisions the certificate and registers the device as remote-access-enabled.

Goal¶

Provision a TLS certificate for sensor-001 and register it with the Remote Access Service in your dev environment.

Prerequisites¶

Remote Access Service deployed and healthy—run stctl remote-access status --env dev and confirm Session broker: ready
stctl authenticated
OpenSSL installed

Steps¶

Step 1—Create the device identity¶

stctl device create \
  --id sensor-001 \
  --type temperature-sensor \
  --remote-access \
  --env dev

The --remote-access flag registers this device with the Remote Access Service in addition to the device registry. Without it, the session broker will reject connection attempts from the device.

Expected output:

✔  Device created
Device ID:          sensor-001
Type:               temperature-sensor
Remote access:      enabled
Status:             pending-certificate

Step 2—Generate a private key on the device¶

The private key must be generated on the device and must never leave it. If you are provisioning remotely (before the device is deployed), generate the key on any machine and transfer it to the device over a secure channel before installation.

openssl genrsa -out sensor-001.key 2048
chmod 600 sensor-001.key

Step 3—Create a Certificate Signing Request¶

openssl req -new \
  -key sensor-001.key \
  -out sensor-001.csr \
  -subj "/CN=sensor-001/O=smarttouch/OU=remote-access"

The OU=remote-access extension tells the SmartTouch certificate authority to issue a certificate with the remote access key usage extension. Certificates without this extension are accepted for MQTT connections but rejected by the Remote Access Service.

Step 4—Sign the certificate¶

stctl device certificate sign \
  --device-id sensor-001 \
  --csr sensor-001.csr \
  --out sensor-001.crt \
  --env dev

Expected output:

✔  Certificate signed
Certificate: sensor-001.crt
Expires:     2027-06-06
Key usage:   clientAuth, remoteAccess
CA bundle:   Downloaded to smarttouch-ca.crt

Confirm Key usage includes remoteAccess. If it shows only clientAuth, the CSR OU was not set correctly — regenerate the CSR with OU=remote-access and re-sign.

Step 5—Verify the device is registered for remote access¶

stctl device status --id sensor-001 --env dev

Expected output:

Device ID:      sensor-001
Status:         active
Remote access:  enabled
Certificate:    valid (expires 2027-06-06, key usage: remoteAccess)
Agent:          not installed
Last seen:      never

Agent: not installed is expected—the Remote Access Agent hasn't been installed yet. You will do that in the next tutorial.

Validation¶

stctl device status --id sensor-001 --env dev
# Remote access: enabled
# Certificate: valid ... key usage: remoteAccess

Troubleshooting¶

Key usage: clientAuth only ('remoteAccess' missing) The CSR was generated without OU=remote-access. Delete the existing CSR, regenerate it with the correct -subj line, and re-sign:

rm sensor-001.csr
openssl req -new -key sensor-001.key -out sensor-001.csr \
  -subj "/CN=sensor-001/O=smarttouch/OU=remote-access"
stctl device certificate sign --device-id sensor-001 --csr sensor-001.csr --out sensor-001.crt --env dev

Error: remote access not enabled for this device type Your organisation's policy restricts which device types can have remote access enabled. Contact your Administrator to add temperature-sensor to the allowed types.

Error: device ID already exists

Run stctl device status --id sensor-001 --env dev to check the existing device. If it doesn't have Remote access: enabled, delete and recreate it with the --remote-access flag.

Next steps¶

sensor-001 has a valid certificate with remote access key usage and is registered with the Remote Access Service.

→ Continue to Step 2: Install the Remote Access Agent