I'm learning AWS and I created a new thing with the required certificates to access it via MQTT:

  • root-CA.crt
  • .private.key
  • .cert.pem

If I'm not wrong the root-CA.crt file will be the same for all the things because it's used to authenticate the server.

What I don't understand if I need to create a different set of certificates (private.key and cert.pem) for every device I will build.

  • This is exactly the question I have been looking for. I the answer of @hardillb is good, but I would arguable say that it is a very very short answer. There is more things to be said about that, I will keep thinking about that and let you know if I anything useful comes to my mind. May 14, 2021 at 22:32

1 Answer 1


Yes, the whole point of using client side certificates is to enable you to reliably uniquely identify each client.

AWS will provide APIs to provision each device with it's own cert/key.

The other reason is that it means that you can easily ban a single device if the certificate is compromised, if every device reuses the same certificate then you have to recall all the devices and update them if somebody gets hold of the key/cert pair.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.