Zoho IoT Application provides the following two ways in which you can create a certificate:

Certificates can be created using the Add Certificate option in the application. Certificates created using this method, can be associated to any existing MQTT device which is registered with the Client Certificate with TLS authentication type. 

 

 

Certificates can be created and associated while adding MQTT Devices. During device creation, the authentication type must be selected as Client Certificate with TLS. Upon registration of this MQTT Device, the Associate Certificate option is displayed to associate any certificate to the device. Here, you can also create a new certificate if required and associate.

Upon creating a certificate, a zip file is created containing the following files. The file must be downloaded and saved for later use after creation.

 

 

The generated certificate, along with private and public keys, can be downloaded from this popup window as a compressed zip file or as individual files. 

 

The ZohoIoTServerRootCA.pem file is a Root Certificate Authority (CA) certificate that must be downloaded and installed when a system does not have a trusted root certificate store available. It contains the public key and other information to establish trust between different entities by allowing them to verify the digital signature on the certificates that are issued by the root CA. In other words, this file acts as a trusted entity to authenticate the identity of the Zoho IOT server during secure communications. 

Every certificate must be mapped to a policy. In general, a policy helps to define various rules and operations. These rules come under two broad categories: "Device communication with the application" and "Application communication with the device". The tasks such as "Telemetry Data", "Device Notification/Event Data", "Subscribe to Command", and "Edge Agent Configuration", are divided under these categories. You can activate one or more actions to define a policy and assign it to a certificate. The certificate, when associated to a device, ensures the device performs only the actions configured in the policy.

 

 

Example: Consider a gateway device that has one or more certificates. This device can use any of the certificates to connect to the application. However, the action which can be performed by the device depends on the policy which is assigned to the certificate used by the device.

 

The list view of the certificate can be accessed from the End Application by clicking Devices > Certificates in the left pane.

The details view contains the details of the certificate along with the associated policy. This view can be accessed by clicking on the certificate name in the list view.

The device view contains the references to the associated devices. This view can be accessed by clicking on the certificate name in the list view displayed above. And clicking on the Attached Gateways tab.

The activities performed on the certificate is listed in the Timeline tab.

 

 

The validity of the Client Certificate is 10 years, and the validity of the Org Root Certificate from which the client certificate is created is 20 years.