When doing fleet registration of IoT devices on AWS' IoT, what is the difference between using CreateCertificateFromCsr and CreateKeysAndCertificate? They seem similar enough to where both are not needed, so why does AWS provide both?

1 Answer 1


In TLS crypto there are a few different objects which are related to each other.

The two basic objects are the private and public keys, which are generated at the same time, and are linked to each other (the private key allows one to decipher data encrypted with the public key, the public key allows one to verify a signature generated with the private key).

The private key should remain secret, and it is best if it actually never moves away from the device where it was generated. The public key is public and can be shared with anyone.

So the best course of operation is to generate the private/public key pair on the device where the private key will be used, and then only communicate the public key and objects derived from it.

The main type of object derived from it is a certificate. A certificate contains the public key, but also identifying information, and it is signed by a certification authority (CA) which vouches for that identifying information.

To get a certificate from the CA, one creates a “certificate signing request” (CSR). One needs the private/public key pair to generate it, and adds the identifying info into the CSR (but since it has not been signed by the CA, that information is not trusted yet).

So the “right” way to do things is as follows:

  • generate private/public key pair on device
  • Generate CSR on device based on the above + identification
  • Send CSR to CA
  • CA verifies somehow that whoever sent the CSR is who they say they are
  • CA created a certificate using the info from the CSR and signs it with their own private key
  • CA returns the certificate
  • Now device has private key and signed certificate.

This is what CreateCertificateFromCsr lets you do. For this you need to generate the private/public key pair, generate the CSR (with the right data), send the CSR using this call, and you get back the certificate.

Now some people are in comfortable doing all this, and they prefer something simpler. And that’s where CreateKeysAndCertificate comes in. You don’t need any input, they will do everything for you: generate the key pair, the CSR, sign it. In the end they will return the private key and certificate, which is all you need.

The difference is that the private key will have been generated on their side and is transmitted over the network, which means someone, either at their end or in between, could try to intercept it, and then act as if they were you. In this scenario this is unlikely, so you can probably save yourself the hassle and use the second one.

  • Thank you for the good explanation.
    – kackle123
    Jul 17, 2023 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.