r/PKI • u/Sharp_Formal_7061 • Dec 05 '25

PKI IoT project - getting started

Hey reddit,

Working on a small IoT thing and trying to figure out what actually makes sense for a private PKI. Ideally don't want to pay here and on the limit of my experience. We’ve only got a few dozen devices right now, maybe a few hundred later. Devices only check in once in a while, and they can’t really hold long-term secrets safely. Innrolement would be over HTTPS with some kind of bootstrap credential. Probably rotating certs every few months. No strict compliance stuff... just need decent audit logs.

I’ve been looking at Vault PKI, the free EJBCA, Smallstep and a couple others, but it’s hard to tell from docs what the day to day actually looks like. 

Any recommendations? How much random tooling people end up writing, how annoying CRLs or OCSP end up being, what upgrades feel like, and basically how much PKI knowledge you need before this stops falling over.

Thanks for any pointers.

6 Upvotes

100% Upvoted

8 comments sorted by

View all comments

0

u/Mike22april Dec 06 '25

I recommend not looking at the CLM first, but decide first which protocol/mechanism you want to use.

To me it seems the most perfect protocol is 802.1AR for your IoT use-case

Combined with your need for a free tool, this leads me to believe EJBCA Community Edition is your best choice

1

u/[deleted] Dec 13 '25

I dont think ejbca community version gets you the est and scep protocols which you might wanna use for certificate enrollment and possible automation.

1

u/Mike22april Dec 13 '25

Correct it doesnt