Working with web certificates

There are 6 scenarios that require renewing operational certificates:

• Operational certificate is expired.
• Root certificate is expired or must be renewed by an IT request.
• Routine periodic renewal of the operational certificate.
• Changes in the project PKI settings.
• Device name, ID or IP address has changed.
• Operational certificate has been compromised.

Working with web root certificates

Base workflow for intermediate web certificates with external CA

ABT Site exports a certificate signing request for its project root signing key. it must be signed by an external CA and deemed trustworthy by the authentication server. The signed certificate is imported back to ABT Site. ABT Site creates an individual device certificate for each device, signed with its project key. It is no longer a trusted root, but part of a longer trust chain.

You can transition from ABT Site as CA to an intermediate solution with an external CA at a later date as needed. The ABT Site root certificate then trusts the external signed certificate to complete the trust chain. Devices need not be reloaded in this case.