IoT fleet certificate management differs from datacenter certificate management. Devices are numerous, remote, sometimes untrusted, and operators care about which physical hardware holds the private key. TigerTrust’s IoT section models devices as first-class inventory objects with their own onboarding, grouping, certificate provisioning, and attestation history.
Iot Devices

​
What it is

Each IoT device is a record in TigerTrust carrying a stable device identifier (whatever your manufacturing pipeline stamps on the hardware), a device type (for example, edge-gateway, sensor-v2, router-lte), and optional manufacturer and firmware metadata. Certificate provisioning and TPM attestation are attached to these records.

​
When to use it

  • Onboard a fleet of edge gateways and ensure each one’s certificate is backed by its TPM.
  • Group devices by type so a single attestation policy applies to all gateways.
  • Track which devices have provisioned certificates and which still need onboarding.
  • Audit attestation history to see which firmware state a device claimed when its certificate was issued.

​
Set it up

1

Open IoT devices

Go to IoT > Devices. You’ll see the full device inventory with status (active, inactive, quarantined) and certificate provisioning rate.
2

Onboard a device

Click Onboard device and enter the device identifier, name, type, manufacturer, and model. Onboarding creates the identity record — it does not provision a certificate yet.
3

Provision a certificate

For TPM-equipped devices, run the attested provisioning flow from the device agent. This proves the private key physically resides in the device’s TPM before the certificate is issued. For devices without a TPM, click Provision certificate on the device record and select a pre-issued certificate to bind.
4

Verify attestation

Click the device row and open the Attestation history tab. Every attestation attempt — successful or failed — appears with the firmware state claimed, the policy that was applied, and the verification outcome.

​
What you’ll see

The IoT > Devices screen shows a summary tile with total devices, active/inactive/quarantined counts, a breakdown by device type, and the certificate provisioning rate (percentage of devices with an active certificate). Each device row shows its current status and last attestation timestamp. Failed attestations carry machine-readable reason codes (for example, pcr_mismatch:7, ek_manufacturer_not_allowed) so you can build alert rules on specific failure modes.

​
Firmware management

TigerTrust also tracks firmware inventory and over-the-air (OTA) update jobs per device. Register a firmware package with a device type and version, then schedule an OTA job for a specific device or group. After a successful firmware update, devices will present new PCR values on their next attestation — update the TPM policy accordingly before rolling out fleet-wide.

TPM attestation

The cryptographic proof that a certificate key physically lives in a specific TPM.

TPM enrollment

One-time Credential Activation that binds an Attestation Key to a device.

TPM policies

Golden PCR values, EK manufacturer allow-lists, and gated issuance.