Ship Once. Operate Forever.
Cumulocrypt M2M Software as a Service (Saas) for IoT issues and manages certificates and keys for device fleets: onboarding, mutual authentication, encryption, and rotation, at the pace and scale IoT runs.
Common deployments: smart metering, industrial sensors, gateways, fleet and telematics, medical and regulated devices, consumer IoT.
The Problem & Our Solution
Why PKI for IoT
Most IoT breaches trace back to the same three problems: a shared secret everyone knows, a key nobody’s tracking, and a certificate that expires without telling anyone. A shared secret is a spare key under the doormat: every device that knows it is a device that could leak it. PKI replaces the doormat key with something that can’t be copied, guessed, or handed around, and puts you in operational control of the full device lifecycle.
- PKI enables you to:
- Prove a device is what it claims to be, not just that it knows a password
- Encrypt telemetry and commands with mTLS
- Rotate credentials routinely and automatically
- Quarantine a compromised device without touching the rest of the fleet
- Keep manufacturing, staging, and production trust separated
What you get
A CA platform and lifecycle automation built for devices. Cumulocrypt M2M for IoT runs your certificate authorities, enrollment endpoints, policy engine, revocation services, and audit trail. It plugs into your manufacturing or provisioning pipeline and your runtime platform.
- Included components:
- CA Hierarchy Manager (root, intermediates, per-tenant or per-product CAs)
- Enrollment Services (EST, ACME, or CMP, depending on environment)
- Policy Engine (templates for device, gateway, service, dev/test/prod)
- Lifecycle Automation (renewal, rotation, re-key, revocation)
- High-performance Validation (OCSP/CRL, chain building, caching)
- PQC Readiness (chimera certificates for hybrid migration)
- Audit and Reporting (who issued what, when, why, and under which policy)
Our Solution Offerings & Key Features
Manufacturing and provisioning
- The device generates a key pair in hardware (TPM or secure element), or has one injected securely
- The device enrolls through factory-line enrollment (“ship ready”) or first-boot enrollment (“zero touch”)
- Cumulocrypt M2M issues a device identity certificate based on policy: product line, model, tenant, region, firmware baseline. You set the policy; Cumulocrypt M2M enforces it
Runtime
- The device uses mTLS to authenticate to the MQTT broker, HTTPS endpoint, or gateway
- Authorization becomes straightforward: the certificate confirms this is MeterModelX in RegionY
Lifecycle
- Certificates renew automatically before expiry, on policy-driven windows
- Rotation and revocation propagate through OCSP/CRLs
- You can enforce short-lived certificates to limit the impact of a leak
Where it fits (architecture snapshot)
- Factory / provisioning: Enrollment Service integrated with manufacturing systems
- Device identity: certificate stored in TPM or secure element
- Cloud / edge: MQTT and HTTPS endpoints require client certificates (mTLS)
- Ops: Cumulocrypt M2M console and API control issuance, renewal, revocation, and reporting
What teams actually do with Cumulocrypt M2M for IoT
- Smart metering: per-utility CA with short-lived device certificates and automated renewals
- Industrial gateways: gateway certificates authenticate thousands of sensors behind them
- Automotive and telematics: signing keys and device identity kept separate, with rapid revocation on compromise
Benefits
Hardened security for IIoT sensors in harsh environments, featuring automated certificate rotation and low-latency mTLS.
- No fleet-wide compromise from one leaked key
- Fewer outages from certificate expiry, through automation and visibility
- Audit-ready device provenance: who, what, and when, for every certificate
- Faster onboarding of new products and tenants, using policy templates
- A path to PQC you can phase in, not a scramble when the algorithms change
Technical Details
Core PKI building blocks
- X.509 certificates (CA hierarchies, intermediates, policy constraints)
- CSR format: PKCS #10
- mTLS for device-to-cloud and device-to-gateway authentication and encryption
- Protocol coverage: MQTT over TLS, HTTPS, and CoAP/DTLS for constrained devices
- Enrollment: EST, ACME, or CMP/CMPv2, depending on environment
- Revocation: CRL and OCSP
- Hardware-backed keys: TPM and secure elements on the device side, PKCS #11 for HSM integration
PQC without drama
Migrating to post-quantum crypto doesn’t have to mean ripping out your PKI and starting over. Chimera certificates combine a classical algorithm and a post-quantum algorithm in a single certificate. They let you add PQC verification without breaking legacy TLS stacks, pilot PQC in one product line, region, or environment first, and expand coverage gradually as your endpoints gain PQC-capable software.
Deployment models
- On-Prem License: air-gapped support, HSM integration, sovereign environments
- Cloud SaaS: multi-region availability, API-first onboarding, managed upgrades
Ask before the security team asks you
- Does it support hardware-backed keys? Yes. It integrates with TPM and secure elements on the device side, and HSM-backed CA keys.
- Can I separate tenants and products? Yes. Per-tenant and per-product CA hierarchies and policies.
- Can I automate everything? Yes. Issuance, renewal, and reporting are all API-driven.
Ready to secure
your device fleet?