Today’s platform update enhances our certificate-based broker authentication and enables programmatic edge workflow deployment.
Device Certificates
Losant has long supported Mutual TLS (mTLS) as a method of authenticating devices against our cloud MQTT broker, but until recently, the feature had very little adoption by our users. That has changed over the last couple months and as a result, we are enhancing the feature set of our certificate-based broker authentication in a number of ways.
Management Through User Interface
First, we've added device certificates and certificate authorities to the platform's user interface, allowing for simple management of these application resources. You can now view a list of certificates; create new certificates for individual devices; define custom topic permissions; and add new certificate authorities to an application as easily as any other resource.
Application developers now have the same visibility over their device certificates as they have over access keys, and can tell at a glance which of their certificates are disabled or approaching expiration.
Certificate: Register Node
We've also introduced a Device Certificate: Register Node for storing a certificate within the application and applying it to a device. This, in combination with the Certificate: Create Node and the certificate / key pair service credential, allows devices to submit a Certificate Signing Request (CSR) and have the workflow generate a certificate that the device can use for authentication, which can then be saved in the application along with the device's topic and IP address restrictions.
This new node enables dynamic device registration and easy rotation of expiring certificates, enhancing your solution's security posture with little additional effort.
Certificate Feature Enhancements
Finally, we added some improvements to device certificates to bring them in line with access keys and to enable new use cases:
- We've added the same IP address connection restrictions to certificates as we added to access keys a few months prior.
- Device certificates are now scoped to a single Losant device only, and that device may be defined after certificate creation (but not changed to another device once set). This enables a dynamic registration flow that allows plug-and-play hardware provisioning.
- Since certificate authorities used to sign device certificates must be saved in the application, and the certificate / key pair service credential allows for easily generating new certificates in the workflow environment, we've added an option to the credential configuration to copy the credential's certificate to device certificate authorities.
- We've added advanced query to certificates, which enables (among other things) a method for identifying all certificates that were signed by a given certificate authority.
Edge: Deploy Node
This release also includes an Edge: Deploy Node that allows for programmatically scheduling deployment of one or more edge workflows to a fleet of edge compute devices within the workflow environment.
This feature fills a critical role in dynamic device registration processes, as edge deployments can now be kicked off immediately after device creation.
Likewise, the feature allows for managing "deployment bundles" at scale – allowing for defining, within the workflow environment, a list of edge workflow versions that should be deployed to specific subsets of edge agents within your application.
We have additional enhancements coming to edge deployment management in the coming releases that will streamline this process even further.
Other Updates
As always, this release comes with other features and improvements, including:
- Edge and embedded workflow deployments now allow for targeting devices based on an advanced device query. The query result intersects with all edge compute or embedded devices in the application, meaning you can, for example, schedule an edge deployment for all devices created after a certain date.
- To match the device certificate functionality, access keys can now be created in an inactive state, allowing another security measure as part of a dynamic provisioning flow. This feature is also available in the Access Key: Create Node.
What’s Next?
With every new release, we listen to your feedback. By combining your suggestions with our roadmap, we can continue to improve the platform while maintaining its ease of use. Let us know what you think in the Losant Forums.