docs-dev/img/est-ca-provisioning-detailed.svg

<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentScriptType="application/ecmascript" contentStyleType="text/css" height="2293px" preserveAspectRatio="none" style="width:1909px;height:2293px;" version="1.1" viewBox="0 0 1909 2293" width="1909px" zoomAndPan="magnify"><defs><filter height="300%" id="fu0bg1xfo7bex" width="300%" x="-1" y="-1"><feGaussianBlur result="blurOut" stdDeviation="2.0"/><feColorMatrix in="blurOut" result="blurOut2" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .4 0"/><feOffset dx="4.0" dy="4.0" in="blurOut2" result="blurOut3"/><feBlend in="SourceGraphic" in2="blurOut3" mode="normal"/></filter></defs><g><text fill="#000000" font-family="sans-serif" font-size="18" lengthAdjust="spacingAndGlyphs" textLength="156" x="873.5" y="26.6992">Device Provisioning</text><rect fill="#ADD8E6" height="2243" style="stroke: #A80036; stroke-width: 1.0;" width="858.5" x="579" y="39.0938"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="42" x="985.75" y="51.1543">Device</text><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="113.7031" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="50.5" y="506.5469"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="113.7031" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="50.5" y="966.5938"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="50.5" y="1291.7031"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="129.9375" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="249.5" y="2046.5156"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="534.5" y="2117.9844"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="400.8125" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="637" y="1810.875"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="220.6719"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="405.8438"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="765.1875"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="865.8906"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="1365.0625"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="1508"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="1845.1094"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="1582.2031" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1355" y="167.2031"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="40.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1360" y="287.1406"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="40.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1360" y="657.4844"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="40.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1360" y="1117.5313"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="40.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1360" y="1431.5313"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="40.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1360" y="1658.9375"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1355" y="1945.8125"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="530.5156" style="stroke: #000000; stroke-width: 2.0;" width="1844" x="23" y="182.2031"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="488.2813" style="stroke: #000000; stroke-width: 2.0;" width="1831" x="23" y="726.7188"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="492.1719" style="stroke: #000000; stroke-width: 2.0;" width="1877" x="13" y="1229"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="460.9375" style="stroke: #000000; stroke-width: 2.0;" width="1857" x="23" y="1253.2344"/><rect fill="#FFFFFF" height="385.2344" style="stroke: none; stroke-width: 1.0;" width="1857" x="23" y="1328.9375"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="462.2813" style="stroke: #000000; stroke-width: 2.0;" width="1221.5" x="222" y="1764.4063"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="55" x2="55" y1="93.7344" y2="2243.6875"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="254" x2="254" y1="93.7344" y2="2243.6875"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="539" x2="539" y1="93.7344" y2="2243.6875"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="642" x2="642" y1="93.7344" y2="2243.6875"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="1077" x2="1077" y1="93.7344" y2="2243.6875"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 5.0,5.0;" x1="1359.5" x2="1359.5" y1="93.7344" y2="2243.6875"/><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="41" x="33" y="58.3281"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="27" x="40" y="78.3164">EST</text><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="41" x="33" y="2242.6875"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="27" x="40" y="2262.6758">EST</text><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="41" x="232" y="58.3281"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="27" x="239" y="78.3164">DPS</text><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="41" x="232" y="2242.6875"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="27" x="239" y="2262.6758">DPS</text><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="63" x="506" y="58.3281"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="49" x="513" y="78.3164">IoT Hub</text><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="63" x="506" y="2242.6875"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="49" x="513" y="2262.6758">IoT Hub</text><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="114" x="583" y="58.3281"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="100" x="590" y="78.3164">Identity Service</text><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="114" x="583" y="2242.6875"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="100" x="590" y="2262.6758">Identity Service</text><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="96" x="1027" y="58.3281"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="82" x="1034" y="78.3164">Keys Service</text><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="96" x="1027" y="2242.6875"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="82" x="1034" y="2262.6758">Keys Service</text><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="143" x="1286.5" y="58.3281"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="129" x="1293.5" y="78.3164">Certificates Service</text><rect fill="#FEFECE" filter="url(#fu0bg1xfo7bex)" height="30.4063" style="stroke: #A80036; stroke-width: 1.5;" width="143" x="1286.5" y="2242.6875"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="129" x="1293.5" y="2262.6758">Certificates Service</text><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="113.7031" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="50.5" y="506.5469"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="113.7031" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="50.5" y="966.5938"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="50.5" y="1291.7031"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="129.9375" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="249.5" y="2046.5156"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="534.5" y="2117.9844"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="400.8125" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="637" y="1810.875"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="220.6719"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="405.8438"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="765.1875"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="865.8906"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="1365.0625"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="1508"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1072" y="1845.1094"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="1582.2031" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1355" y="167.2031"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="40.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1360" y="287.1406"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="40.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1360" y="657.4844"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="40.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1360" y="1117.5313"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="40.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1360" y="1431.5313"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="40.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1360" y="1658.9375"/><rect fill="#FFFFFF" filter="url(#fu0bg1xfo7bex)" height="29.2344" style="stroke: #A80036; stroke-width: 1.0;" width="10" x="1355" y="1945.8125"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1360" x2="1402" y1="124.9688" y2="124.9688"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1402" x2="1402" y1="124.9688" y2="137.9688"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1361" x2="1402" y1="137.9688" y2="137.9688"/><polygon fill="#A80036" points="1371,133.9688,1361,137.9688,1371,141.9688,1367,137.9688" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="1367" y="119.7949">1</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="344" x="1378" y="119.7949">At first, the bootstrap ID cert is used as the EST identity cert</text><polygon fill="#A80036" points="1343,163.2031,1353,167.2031,1343,171.2031,1347,167.2031" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="642" x2="1349" y1="167.2031" y2="167.2031"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="649" y="162.0293">2</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="161" x="660" y="162.0293">Get current EST identity cert</text><path d="M23,182.2031 L96,182.2031 L96,189.2031 L86,199.2031 L23,199.2031 L23,182.2031 " fill="#EEEEEE" style="stroke: #000000; stroke-width: 1.0;"/><rect fill="none" height="530.5156" style="stroke: #000000; stroke-width: 2.0;" width="1844" x="23" y="182.2031"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="28" x="38" y="195.2637">loop</text><text fill="#000000" font-family="sans-serif" font-size="11" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="250" x="111" y="194.4082">[for creating and renewing EST identity cert]</text><polygon fill="#A80036" points="1093,216.6719,1083,220.6719,1093,224.6719,1089,220.6719" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1087" x2="1354" y1="220.6719" y2="220.6719"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="1099" y="215.498">3</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="236" x="1110" y="215.498">Get current EST identity cert's private key</text><polygon fill="#A80036" points="1343,245.9063,1353,249.9063,1343,253.9063,1347,249.9063" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1077" x2="1349" y1="249.9063" y2="249.9063"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="1084" y="244.7324">4</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="63" x="1095" y="244.7324">Key handle</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1412" y1="274.1406" y2="274.1406"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1412" x2="1412" y1="274.1406" y2="287.1406"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1371" x2="1412" y1="287.1406" y2="287.1406"/><polygon fill="#A80036" points="1381,283.1406,1371,287.1406,1381,291.1406,1377,287.1406" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="1377" y="268.9668">5</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="161" x="1388" y="268.9668">Get current EST identity cert</text><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1370" x2="1412" y1="326.375" y2="326.375"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1412" x2="1412" y1="326.375" y2="339.375"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1365" x2="1412" y1="339.375" y2="339.375"/><polygon fill="#A80036" points="1375,335.375,1365,339.375,1375,343.375,1371,339.375" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="1377" y="321.2012">6</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="25" x="1388" y="321.2012">PEM</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1407" y1="363.6094" y2="363.6094"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1407" x2="1407" y1="363.6094" y2="376.6094"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1366" x2="1407" y1="376.6094" y2="376.6094"/><polygon fill="#A80036" points="1376,372.6094,1366,376.6094,1376,380.6094,1372,376.6094" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="1372" y="358.4355">7</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="393" x="1383" y="358.4355">Create TLS client using key handle + PEM (using openssl-engine-ks)</text><polygon fill="#A80036" points="1093,401.8438,1083,405.8438,1093,409.8438,1089,405.8438" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1087" x2="1354" y1="405.8438" y2="405.8438"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="1099" y="400.6699">8</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="197" x="1110" y="400.6699">Generate new asymmetric key pair</text><polygon fill="#A80036" points="1343,431.0781,1353,435.0781,1343,439.0781,1347,435.0781" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1077" x2="1349" y1="435.0781" y2="435.0781"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="7" x="1084" y="429.9043">9</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="63" x="1095" y="429.9043">Key handle</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1407" y1="464.3125" y2="464.3125"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1407" x2="1407" y1="464.3125" y2="477.3125"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1366" x2="1407" y1="477.3125" y2="477.3125"/><polygon fill="#A80036" points="1376,473.3125,1366,477.3125,1376,481.3125,1372,477.3125" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1372" y="459.1387">10</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="465" x="1390" y="459.1387">Create CSR for new EST identity cert using key handle (using openssl-engine-ks)</text><polygon fill="#A80036" points="71.5,502.5469,61.5,506.5469,71.5,510.5469,67.5,506.5469" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="65.5" x2="1354" y1="506.5469" y2="506.5469"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="77.5" y="501.373">11</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="634" x="95.5" y="501.373">Connect using TLS client and perform EST enrolment to get a new EST identity cert corresponding to the CSR</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="60.5" x2="102.5" y1="535.7813" y2="535.7813"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="102.5" x2="102.5" y1="535.7813" y2="548.7813"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="61.5" x2="102.5" y1="548.7813" y2="548.7813"/><polygon fill="#A80036" points="71.5,544.7813,61.5,548.7813,71.5,552.7813,67.5,548.7813" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="67.5" y="530.6074">12</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="157" x="85.5" y="530.6074">Verify client cert against CA</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="60.5" x2="102.5" y1="578.0156" y2="578.0156"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="102.5" x2="102.5" y1="578.0156" y2="591.0156"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="61.5" x2="102.5" y1="591.0156" y2="591.0156"/><polygon fill="#A80036" points="71.5,587.0156,61.5,591.0156,71.5,595.0156,67.5,591.0156" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="67.5" y="572.8418">13</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="55" x="85.5" y="572.8418">Sign CSR</text><polygon fill="#A80036" points="1343,616.25,1353,620.25,1343,624.25,1347,620.25" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="55.5" x2="1349" y1="620.25" y2="620.25"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="62.5" y="615.0762">14</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="67" x="80.5" y="615.0762">Signed cert</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1412" y1="644.4844" y2="644.4844"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1412" x2="1412" y1="644.4844" y2="657.4844"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1371" x2="1412" y1="657.4844" y2="657.4844"/><polygon fill="#A80036" points="1381,653.4844,1371,657.4844,1381,661.4844,1377,657.4844" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1377" y="639.3105">15</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="353" x="1395" y="639.3105">Import signed cert as the EST identity cert for future requests</text><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1370" x2="1412" y1="696.7188" y2="696.7188"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1412" x2="1412" y1="696.7188" y2="709.7188"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1365" x2="1412" y1="709.7188" y2="709.7188"/><polygon fill="#A80036" points="1375,705.7188,1365,709.7188,1375,713.7188,1371,709.7188" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1377" y="691.5449">16</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="0" x="1398" y="691.5449"/><path d="M23,726.7188 L96,726.7188 L96,733.7188 L86,743.7188 L23,743.7188 L23,726.7188 " fill="#EEEEEE" style="stroke: #000000; stroke-width: 1.0;"/><rect fill="none" height="488.2813" style="stroke: #000000; stroke-width: 2.0;" width="1831" x="23" y="726.7188"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="28" x="38" y="739.7793">loop</text><text fill="#000000" font-family="sans-serif" font-size="11" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="413" x="111" y="738.9238">[for creating and renewing device CA cert (if needed to mint other certs)]</text><polygon fill="#A80036" points="1093,761.1875,1083,765.1875,1093,769.1875,1089,765.1875" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1087" x2="1354" y1="765.1875" y2="765.1875"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1099" y="760.0137">17</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="236" x="1117" y="760.0137">Get current EST identity cert's private key</text><polygon fill="#A80036" points="1343,790.4219,1353,794.4219,1343,798.4219,1347,794.4219" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1077" x2="1349" y1="794.4219" y2="794.4219"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1084" y="789.248">18</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="63" x="1102" y="789.248">Key handle</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1407" y1="823.6563" y2="823.6563"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1407" x2="1407" y1="823.6563" y2="836.6563"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1366" x2="1407" y1="836.6563" y2="836.6563"/><polygon fill="#A80036" points="1376,832.6563,1366,836.6563,1376,840.6563,1372,836.6563" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1372" y="818.4824">19</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="393" x="1390" y="818.4824">Create TLS client using key handle + PEM (using openssl-engine-ks)</text><polygon fill="#A80036" points="1093,861.8906,1083,865.8906,1093,869.8906,1089,865.8906" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1087" x2="1354" y1="865.8906" y2="865.8906"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1099" y="860.7168">20</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="197" x="1117" y="860.7168">Generate new asymmetric key pair</text><polygon fill="#A80036" points="1343,891.125,1353,895.125,1343,899.125,1347,895.125" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1077" x2="1349" y1="895.125" y2="895.125"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1084" y="889.9512">21</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="63" x="1102" y="889.9512">Key handle</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1407" y1="924.3594" y2="924.3594"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1407" x2="1407" y1="924.3594" y2="937.3594"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1366" x2="1407" y1="937.3594" y2="937.3594"/><polygon fill="#A80036" points="1376,933.3594,1366,937.3594,1376,941.3594,1372,937.3594" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1372" y="919.1855">22</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="452" x="1390" y="919.1855">Create CSR for new device CA cert using key handle (using openssl-engine-ks)</text><polygon fill="#A80036" points="71.5,962.5938,61.5,966.5938,71.5,970.5938,67.5,966.5938" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="65.5" x2="1354" y1="966.5938" y2="966.5938"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="77.5" y="961.4199">23</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="534" x="95.5" y="961.4199">Connect using TLS client and send request for new device CA cert corresponding to the CSR</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="60.5" x2="102.5" y1="995.8281" y2="995.8281"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="102.5" x2="102.5" y1="995.8281" y2="1008.8281"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="61.5" x2="102.5" y1="1008.8281" y2="1008.8281"/><polygon fill="#A80036" points="71.5,1004.8281,61.5,1008.8281,71.5,1012.8281,67.5,1008.8281" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="67.5" y="990.6543">24</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="157" x="85.5" y="990.6543">Verify client cert against CA</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="60.5" x2="102.5" y1="1038.0625" y2="1038.0625"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="102.5" x2="102.5" y1="1038.0625" y2="1051.0625"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="61.5" x2="102.5" y1="1051.0625" y2="1051.0625"/><polygon fill="#A80036" points="71.5,1047.0625,61.5,1051.0625,71.5,1055.0625,67.5,1051.0625" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="67.5" y="1032.8887">25</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="55" x="85.5" y="1032.8887">Sign CSR</text><polygon fill="#A80036" points="1343,1076.2969,1353,1080.2969,1343,1084.2969,1347,1080.2969" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="55.5" x2="1349" y1="1080.2969" y2="1080.2969"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="62.5" y="1075.123">26</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="67" x="80.5" y="1075.123">Signed cert</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1412" y1="1104.5313" y2="1104.5313"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1412" x2="1412" y1="1104.5313" y2="1117.5313"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1371" x2="1412" y1="1117.5313" y2="1117.5313"/><polygon fill="#A80036" points="1381,1113.5313,1371,1117.5313,1381,1121.5313,1377,1117.5313" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1377" y="1099.3574">27</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="229" x="1395" y="1099.3574">Import signed cert as the device CA cert</text><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1370" x2="1412" y1="1156.7656" y2="1156.7656"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1412" x2="1412" y1="1156.7656" y2="1169.7656"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1365" x2="1412" y1="1169.7656" y2="1169.7656"/><polygon fill="#A80036" points="1375,1165.7656,1365,1169.7656,1375,1173.7656,1371,1169.7656" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1377" y="1151.5918">28</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="0" x="1398" y="1151.5918"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1407" y1="1194" y2="1194"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1407" x2="1407" y1="1194" y2="1207"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1366" x2="1407" y1="1207" y2="1207"/><polygon fill="#A80036" points="1376,1203,1366,1207,1376,1211,1372,1207" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1372" y="1188.8262">29</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="328" x="1390" y="1188.8262">Wait for the device CA cert to be near expiry (active timer)</text><path d="M13,1229 L86,1229 L86,1236 L76,1246 L13,1246 L13,1229 " fill="#EEEEEE" style="stroke: #000000; stroke-width: 1.0;"/><rect fill="none" height="492.1719" style="stroke: #000000; stroke-width: 2.0;" width="1877" x="13" y="1229"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="28" x="28" y="1242.0605">loop</text><text fill="#000000" font-family="sans-serif" font-size="11" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="266" x="101" y="1241.2051">[for creating and renewing device identity cert]</text><path d="M23,1253.2344 L86,1253.2344 L86,1260.2344 L76,1270.2344 L23,1270.2344 L23,1253.2344 " fill="#EEEEEE" style="stroke: #000000; stroke-width: 1.0;"/><rect fill="none" height="460.9375" style="stroke: #000000; stroke-width: 2.0;" width="1857" x="23" y="1253.2344"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="18" x="38" y="1266.2949">alt</text><text fill="#000000" font-family="sans-serif" font-size="11" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="335" x="101" y="1265.4395">[if user configured device identity to be obtained from EST]</text><polygon fill="#A80036" points="71.5,1287.7031,61.5,1291.7031,71.5,1295.7031,67.5,1291.7031" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="65.5" x2="1354" y1="1291.7031" y2="1291.7031"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="77.5" y="1286.5293">30</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="252" x="95.5" y="1286.5293">Similar process as for device CA cert above</text><polygon fill="#A80036" points="1343,1316.9375,1353,1320.9375,1343,1324.9375,1347,1320.9375" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="55.5" x2="1349" y1="1320.9375" y2="1320.9375"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="62.5" y="1315.7637">31</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="67" x="80.5" y="1315.7637">Signed cert</text><line style="stroke: #000000; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="23" x2="1880" y1="1329.9375" y2="1329.9375"/><text fill="#000000" font-family="sans-serif" font-size="11" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="308" x="28" y="1340.1426">[if user configured device identity to be minted locally]</text><polygon fill="#A80036" points="1093,1361.0625,1083,1365.0625,1093,1369.0625,1089,1365.0625" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1087" x2="1354" y1="1365.0625" y2="1365.0625"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1099" y="1359.8887">32</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="223" x="1117" y="1359.8887">Get current device CA cert's private key</text><polygon fill="#A80036" points="1343,1390.2969,1353,1394.2969,1343,1398.2969,1347,1394.2969" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1077" x2="1349" y1="1394.2969" y2="1394.2969"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1084" y="1389.123">33</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="63" x="1102" y="1389.123">Key handle</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1412" y1="1418.5313" y2="1418.5313"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1412" x2="1412" y1="1418.5313" y2="1431.5313"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1371" x2="1412" y1="1431.5313" y2="1431.5313"/><polygon fill="#A80036" points="1381,1427.5313,1371,1431.5313,1381,1435.5313,1377,1431.5313" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1377" y="1413.3574">34</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="148" x="1395" y="1413.3574">Get current device CA cert</text><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1370" x2="1412" y1="1470.7656" y2="1470.7656"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1412" x2="1412" y1="1470.7656" y2="1483.7656"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1365" x2="1412" y1="1483.7656" y2="1483.7656"/><polygon fill="#A80036" points="1375,1479.7656,1365,1483.7656,1375,1487.7656,1371,1483.7656" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1377" y="1465.5918">35</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="25" x="1395" y="1465.5918">PEM</text><polygon fill="#A80036" points="1093,1504,1083,1508,1093,1512,1089,1508" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1087" x2="1354" y1="1508" y2="1508"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1099" y="1502.8262">36</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="197" x="1117" y="1502.8262">Generate new asymmetric key pair</text><polygon fill="#A80036" points="1343,1533.2344,1353,1537.2344,1343,1541.2344,1347,1537.2344" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1077" x2="1349" y1="1537.2344" y2="1537.2344"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1084" y="1532.0605">37</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="63" x="1102" y="1532.0605">Key handle</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1407" y1="1566.4688" y2="1566.4688"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1407" x2="1407" y1="1566.4688" y2="1579.4688"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1366" x2="1407" y1="1579.4688" y2="1579.4688"/><polygon fill="#A80036" points="1376,1575.4688,1366,1579.4688,1376,1583.4688,1372,1579.4688" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1372" y="1561.2949">38</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="478" x="1390" y="1561.2949">Create CSR for new device identity cert using key handle (using openssl-engine-ks)</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1407" y1="1608.7031" y2="1608.7031"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1407" x2="1407" y1="1608.7031" y2="1621.7031"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1366" x2="1407" y1="1621.7031" y2="1621.7031"/><polygon fill="#A80036" points="1376,1617.7031,1366,1621.7031,1376,1625.7031,1372,1621.7031" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1372" y="1603.5293">39</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="175" x="1390" y="1603.5293">Sign CSR using device CA cert</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="1365" x2="1412" y1="1645.9375" y2="1645.9375"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1412" x2="1412" y1="1645.9375" y2="1658.9375"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="1371" x2="1412" y1="1658.9375" y2="1658.9375"/><polygon fill="#A80036" points="1381,1654.9375,1371,1658.9375,1381,1662.9375,1377,1658.9375" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1377" y="1640.7637">40</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="255" x="1395" y="1640.7637">Import signed cert as the device identity cert</text><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1370" x2="1412" y1="1698.1719" y2="1698.1719"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1412" x2="1412" y1="1698.1719" y2="1711.1719"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="1365" x2="1412" y1="1711.1719" y2="1711.1719"/><polygon fill="#A80036" points="1375,1707.1719,1365,1711.1719,1375,1715.1719,1371,1711.1719" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="1377" y="1692.998">41</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="0" x="1398" y="1692.998"/><polygon fill="#A80036" points="653,1745.4063,643,1749.4063,653,1753.4063,649,1749.4063" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="647" x2="1359" y1="1749.4063" y2="1749.4063"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="659" y="1744.2324">42</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="25" x="677" y="1744.2324">PEM</text><path d="M222,1764.4063 L295,1764.4063 L295,1771.4063 L285,1781.4063 L222,1781.4063 L222,1764.4063 " fill="#EEEEEE" style="stroke: #000000; stroke-width: 1.0;"/><rect fill="none" height="462.2813" style="stroke: #000000; stroke-width: 2.0;" width="1221.5" x="222" y="1764.4063"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="28" x="237" y="1777.4668">loop</text><text fill="#000000" font-family="sans-serif" font-size="11" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="120" x="310" y="1776.6113">[for (re-)provisioning]</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="642" x2="689" y1="1797.875" y2="1797.875"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="689" x2="689" y1="1797.875" y2="1810.875"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="648" x2="689" y1="1810.875" y2="1810.875"/><polygon fill="#A80036" points="658,1806.875,648,1810.875,658,1814.875,654,1810.875" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="654" y="1792.7012">43</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="123" x="672" y="1792.7012">Request provisioning</text><polygon fill="#A80036" points="1060,1841.1094,1070,1845.1094,1060,1849.1094,1064,1845.1094" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="647" x2="1066" y1="1845.1094" y2="1845.1094"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="654" y="1839.9355">44</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="249" x="672" y="1839.9355">Get current device identity cert's private key</text><polygon fill="#A80036" points="658,1870.3438,648,1874.3438,658,1878.3438,654,1874.3438" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="652" x2="1076" y1="1874.3438" y2="1874.3438"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="664" y="1869.1699">45</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="63" x="682" y="1869.1699">Key handle</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="647" x2="689" y1="1903.5781" y2="1903.5781"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="689" x2="689" y1="1903.5781" y2="1916.5781"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="648" x2="689" y1="1916.5781" y2="1916.5781"/><polygon fill="#A80036" points="658,1912.5781,648,1916.5781,658,1920.5781,654,1916.5781" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="654" y="1898.4043">46</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="177" x="672" y="1898.4043">Check EST identity cert validity</text><polygon fill="#A80036" points="1343,1941.8125,1353,1945.8125,1343,1949.8125,1347,1945.8125" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="647" x2="1349" y1="1945.8125" y2="1945.8125"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="654" y="1940.6387">47</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="174" x="672" y="1940.6387">Get current device identity cert</text><polygon fill="#A80036" points="658,1971.0469,648,1975.0469,658,1979.0469,654,1975.0469" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="652" x2="1359" y1="1975.0469" y2="1975.0469"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="664" y="1969.873">48</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="25" x="682" y="1969.873">PEM</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="647" x2="689" y1="2004.2813" y2="2004.2813"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="689" x2="689" y1="2004.2813" y2="2017.2813"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="648" x2="689" y1="2017.2813" y2="2017.2813"/><polygon fill="#A80036" points="658,2013.2813,648,2017.2813,658,2021.2813,654,2017.2813" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="654" y="1999.1074">49</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="393" x="672" y="1999.1074">Create TLS client using key handle + PEM (using openssl-engine-ks)</text><polygon fill="#A80036" points="270.5,2042.5156,260.5,2046.5156,270.5,2050.5156,266.5,2046.5156" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="264.5" x2="636" y1="2046.5156" y2="2046.5156"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="276.5" y="2041.3418">50</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="324" x="294.5" y="2041.3418">Connect using TLS client and send provisioning request</text><line style="stroke: #A80036; stroke-width: 1.0;" x1="259.5" x2="301.5" y1="2075.75" y2="2075.75"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="301.5" x2="301.5" y1="2075.75" y2="2088.75"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="260.5" x2="301.5" y1="2088.75" y2="2088.75"/><polygon fill="#A80036" points="270.5,2084.75,260.5,2088.75,270.5,2092.75,266.5,2088.75" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="266.5" y="2070.5762">51</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="243" x="284.5" y="2070.5762">Verify client cert against device identity CA</text><polygon fill="#A80036" points="522.5,2113.9844,532.5,2117.9844,522.5,2121.9844,526.5,2117.9844" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0;" x1="259.5" x2="528.5" y1="2117.9844" y2="2117.9844"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="266.5" y="2112.8105">52</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="89" x="284.5" y="2112.8105">Register device</text><polygon fill="#A80036" points="270.5,2143.2188,260.5,2147.2188,270.5,2151.2188,266.5,2147.2188" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="264.5" x2="538.5" y1="2147.2188" y2="2147.2188"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="276.5" y="2142.0449">53</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="0" x="297.5" y="2142.0449"/><polygon fill="#A80036" points="625,2172.4531,635,2176.4531,625,2180.4531,629,2176.4531" style="stroke: #A80036; stroke-width: 1.0;"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="254.5" x2="631" y1="2176.4531" y2="2176.4531"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="261.5" y="2171.2793">54</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="253" x="279.5" y="2171.2793">Provisioning info (IoT Hub + device identity)</text><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="647" x2="689" y1="2210.6875" y2="2210.6875"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="689" x2="689" y1="2210.6875" y2="2223.6875"/><line style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 2.0,2.0;" x1="642" x2="689" y1="2223.6875" y2="2223.6875"/><polygon fill="#A80036" points="652,2219.6875,642,2223.6875,652,2227.6875,648,2223.6875" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" font-weight="bold" lengthAdjust="spacingAndGlyphs" textLength="14" x="654" y="2205.5137">55</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="127" x="672" y="2205.5137">Ok(ProvisioningDone)</text><!--MD5=[a23c732325d32721f547d75d6077cb04]
@startuml

title Device Provisioning

participant "EST" as est
participant "DPS" as dps
participant "IoT Hub" as hub

box Device #LightBlue
	participant "Identity Service" as is
	participant "Keys Service" as ks
	participant "Certificates Service" as cs
end box

autonumber

cs -> cs: At first, the bootstrap ID cert is used as the EST identity cert

is -> cs ++: Get current EST identity cert
loop for creating and renewing EST identity cert
	cs -> ks ++: Get current EST identity cert's private key
	return Key handle
	cs -> cs ++: Get current EST identity cert
	return PEM
	cs -> cs: Create TLS client using key handle + PEM (using openssl-engine-ks)

	cs -> ks ++: Generate new asymmetric key pair
	return Key handle
	cs -> cs: Create CSR for new EST identity cert using key handle (using openssl-engine-ks)

	cs -> est ++: Connect using TLS client and perform EST enrolment to get a new EST identity cert corresponding to the CSR
	est -> est: Verify client cert against CA
	est -> est: Sign CSR
	return Signed cert
	cs -> cs ++: Import signed cert as the EST identity cert for future requests
	return
end

loop for creating and renewing device CA cert (if needed to mint other certs)
	cs -> ks ++: Get current EST identity cert's private key
	return Key handle
	cs -> cs: Create TLS client using key handle + PEM (using openssl-engine-ks)

	cs -> ks ++: Generate new asymmetric key pair
	return Key handle
	cs -> cs: Create CSR for new device CA cert using key handle (using openssl-engine-ks)

	cs -> est ++: Connect using TLS client and send request for new device CA cert corresponding to the CSR
	est -> est: Verify client cert against CA
	est -> est: Sign CSR
	return Signed cert
	cs -> cs ++: Import signed cert as the device CA cert
	return
	cs -> cs: Wait for the device CA cert to be near expiry (active timer)
end

loop for creating and renewing device identity cert
	alt if user configured device identity to be obtained from EST
		cs -> est ++: Similar process as for device CA cert above
		return Signed cert

	else if user configured device identity to be minted locally
		cs -> ks ++: Get current device CA cert's private key
		return Key handle
		cs -> cs ++: Get current device CA cert
		return PEM

		cs -> ks ++: Generate new asymmetric key pair
		return Key handle
		cs -> cs: Create CSR for new device identity cert using key handle (using openssl-engine-ks)
		cs -> cs: Sign CSR using device CA cert

		cs -> cs ++: Import signed cert as the device identity cert
		return
	end
end
return PEM

loop for (re-)provisioning
	is -> is ++: Request provisioning
	is -> ks ++: Get current device identity cert's private key
	return Key handle
	is -> is: Check EST identity cert validity
	is -> cs ++: Get current device identity cert
	return PEM
	is -> is: Create TLS client using key handle + PEM (using openssl-engine-ks)
	is -> dps ++: Connect using TLS client and send provisioning request
	dps -> dps: Verify client cert against device identity CA
	dps -> hub ++: Register device
	return
	return Provisioning info (IoT Hub + device identity)
	return Ok(ProvisioningDone)
end


@enduml

PlantUML version 1.2020.17(Sat Sep 19 05:30:11 PDT 2020)
(GPL source distribution)
Java Runtime: OpenJDK Runtime Environment
JVM: OpenJDK 64-Bit Server VM
Default Encoding: UTF-8
Language: en
Country: US
--></g></svg>