Scenario: Create a Digital Twin Instance that uses a mTLS Certificate

1. Go to Identity & Security, and then select Vault.
2. Select the Compartment you want to use for your IoT resources.
3. To create a key, select Create Key and follow the instructions in Creating a Master Encryption Key.
4. Or from the list of Vaults, select the Actions menu next to the Vault you want to use, and then select View Vault Details.
5. Select Master encryption keys to view Keys. Select View Key Details to find the Protection Mode and confirm it's HSM (Hardware Security Module).

1. Log in as an Administrator, with the correct policies to perform these actions. You must have the appropriate level of security access to create a CA.
2. On the Certificate Authorities list page, select Create Certificate Authority. If you need help finding the list page, see Listing Certificate Authorities.
3. Select Compartment, and then select the compartment where you want to create the CA.
4. Under Certificate Authority Type, select the type Subordinate Certificate Authority: any CA that's not the root CA in a hierarchy containing other CAs.
5. (Optional) Enter a unique display name for the CA. This name helps you identify the CA for administrative purposes but doesn't appear as part of the CA certificate. Avoid entering confidential information.
   Note
   
   No two CAs in a tenancy can share the same name, including CAs pending deletion.
6. (Optional) To apply tags, select Show Tagging Options. For more information about tags, see Resource Tags.
7. Select Next.
8. Enter subject information. Subject information includes at least a common name (CN) to identify the owner of the CA certificate. Depending on the certificate's intended use, the subject might identify a person, organization, computer endpoint, or a device. The format of the subject information must conform to RFC 5280 standards. You can use wildcards to issue a certificate for multiple domain or subdomain names.
9. Select Next.
10. Under Authority Configuration, confirm or select the vault that contains the encryption key that you want to use for the CA certificate. Optionally, select Change Compartment to specify a different compartment. For information about creating and managing vaults, see Managing Vaults.
11. Under Key, select the key in the vault that you want to use. The list includes only the asymmetric keys in the vault because Certificates only supports asymmetric keys. You can select from Rivest-Shamir-Adleman (RSA) keys that are 2,048 bits or 4,096 bits. You can also select elliptic curve cryptography digital signature algorithm (ECDSA) keys that have an elliptic curve ID of NIST_P384. Specifically, the list includes only these types of asymmetric keys that are protected by a hardware security module (HSM). Certificates don't support the use of software-protected keys. For more information about creating and managing keys, see Managing Keys.
12. Under Signing Algorithm, depending on the key algorithm family select one of the following options:
    • SHA256_WITH_RSA: RSA key with a SHA-256 hash function
    • SHA384_WITH_RSA: RSA key with a SHA-384 hash function
    • SHA512_WITH_RSA: RSA key with a SHA-512 hash function
    • SHA256_WITH_ECDSA: ECDSA key with a SHA-256 hash function
    • SHA384_WITH_ECDSA: ECDSA key with a SHA-384 hash function
    • SHA512_WITH_ECDSA: ECDSA key with a SHA-512 hash function
13. Select Next.
14. Configure the expiry rule. Under Maximum Validity Duration for Certificates (Days), specify the maximum number of days that a certificate issued by this CA can be valid. We strongly recommend a validity period of no more than 90 days.
15. On the Revocation Configuration page, if you don't want to configure a certificate revocation list (CRL), select the Skip Revocation checkbox.
16. Select Next.
17. Confirm that the information is correct, and then select Create Certificate Authority. It can take a few minutes to create certificate-related resources.
18. If the Certificate Authority was successfully created, then the summary details is displayed.

1. Use this command to generate a new private key private.pem and a certificate signing request csr.pem with RSA 2048-bit encryption. This example shows using the -nodes parameter that specifies without password protection and uses the v3_req extensions.

   openssl req -nodes -newkey rsa:2048 -keyout private.pem -out csr.pem -extensions v3_req

   Note
   
   If you are using Linux, by default the OpenSSL.cnf file comments out the extension, for example, if you see something like this in the OpenSSL config file: /etc/pki/tls/openssl.cnf

    # req_extensions = v3_req # The extensions to add to a certificate request

   Then remove the # to uncomment out the extensions, so the file looks something like this:

   req_extensions = v3_req  # The extensions to add to a certificate request

   To verify OpenSSL is using extensions v3_req you can verify the output contains:

   X509v3 extensions:
       X509v3 Basic Constraints: critical
           CA:FALSE

2. This example shows the certificate request input fields and example values. Enter information that will be incorporated into your certificate report, as a Distinguished Name (DN).

   Enter the common name. You can find the common name on the Subject Information tab of the Certificate details page, see step 8 Create a Certificate Authority or for help finding the certificate details page, see Listing Certificates:

   Country Name (2 letter code) []: US
   State or Province Name (full name) [Some-State]:
   Locality Name (eg, city) []:
   Organization Name (eg, company) []:
   Organizational Unit Name (eg, section) []:
   Common Name (Enter common name from the certificate details.) []:common-name
   Email Address [your@email.com]:
   
   Please enter the following 'extra' attributes
   to be sent with your certificate request
   A challenge password []:
   An optional company name []:

1. In the Console, open the navigation menu, select Identity & Security.
2. On the Certificates list page, the list of Certificate Authority for a specific compartment is displayed.
3. Find the Certificate you want to work with, select the Actions menu at the end of the row.
4. Select Issue Certificate.
5. Under Certificate Type, to issue a certificate from a Certificates service CA that's managed by an external, third-party CA, select Issued by internal CA, managed externally.
6. Enter a unique display name for the certificate. Avoid entering confidential information.
   Note
   
   No two certificates in the tenancy can share the same name, including certificates pending deletion.
7. (Optional) Enter a description to help identify the certificate. Avoid entering confidential information.
8. For certificates that a third-party CA manages, you don't need to provide subject information. Instead, select Next.
9. Under Certificate Signing Request, provide certificate contents by selecting Upload File, and then select Select One to upload the certificate as a file in PEM format.
10. Or select Paste Content, and then select the text box to paste the certificate contents directly.
11. Select Next.
12. You can't configure automatic renewal for certificates that the Certificates service doesn't manage. Select Next to continue.
13. Verify the summary information is correct, and then select Create Certificate.
14. View the Certificate details page opens. Under the Versions, find the name of the certificate you want to view, go to the Actions menu at the end of the row, select View Content. For more information, see Viewing Certificate Details.
15. Select Download and Save the Certificate PEM file.
16. On the Certificate details page, go to the Subject information tab, copy the Common Name for the certificate to use in the next step.

select * from <domain-short-id-from-device-host>__IOT.RAW_DATA
where digital_twin_instance_id = '<digital-twin-instance-ocid>'