Smart Hub authentication

The Smart Hub uses certificates for authentication with its clients that include Smart Agents and Application Server. The Smart Hub communication with its clients is established after you complete the following tasks:

  1. Provide a shared secret key (SSK) during Smart Hub installation.
  2. Provide the same SSK while registering the Smart Hub in the Application Server.
  3. Configure the Smart Agent to specify the Smart Hub details, such as host name, port number, and the access key.

The authentication mechanism works as follows:

Authentication between the Smart Hub and Application Server

  1. The Application Server sends a certificate signing request (CSR) to the Smart Hub along with the authentication details created using SSK.
  2. The Smart Hub verifies the authentication details using SSK. It acts as a private CA and has its own signer certificates.
  3. The Smart Hub creates a signed certificate, and sends it to the Application Server. The certificate includes the public key.
  4. The Application Server saves the certificate in the database and displays it as an encoded access key on the UI.
  5. The Application Server uses this stored certificate during the future communication with the Smart Hub.

The Application Server uses SSK only for the first certificate, and SSK is not stored by the Application Server.

Authentication between the Smart Hub and Smart Agents

  1. The Smart Agent sends a certificate signing request (CSR) to the Smart Hub along with the authentication details created using the access key.
  2. The Smart Hub verifies the details using the private key.
  3. The Smart Hub issues a certificate to the Smart Agent.
  4. The Smart Agent saves the signed certificate and uses it for all the future communication with the Smart Hub.

This access key is stored in the Smart Agent configuration file and is protected by the file system permissions. The Smart Agent uses the access key only for the first certificate request. When the Smart Agent receives the certificate, the access key is removed from the configuration file.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*