Step A - Configure a CA certificate for your tenant

In case of multiple subscriptions, make sure you are acting in the context of your relevant subscription.

For that, in the header bar of the Bosch IoT Suite UI, click the folder icon, which opens the Service Subscription dialog.

If the displayed Instance name is not the proper one, click the Switch subscription button and select the relevant subscription from the list that is displayed.

Then:

1. Open the Certificates UI feature from the left navigation.

   In case it is not there yet, click Search Services and features, then click the star icon in the Certificates tile to pin the entry to the left navigation.

2. Click the + icon to get the Add root certificate entry fields.

3. Enter a unique name for the certificate.

4. Provide the content of the root certificate in PEM format: load it from a file or paste it directly in the editor.
   If you choose to load it from a file, click the Load PEM file button.
   Select an existing PEM file from the local folder where you have stored it and confirm with Open to upload it.
   The certificate entry field will be filled with the Base64 encoded certificate.

5. Enable the automatic provisioning by activating the toggle button Auto-provisioning enabled.

6. Enter a template for the generation of the device ID in the format your.namespace:{{subject-dn}} or your.namespace:{{subject-cn}}. Please, keep the placeholder in exactly the notation given in the context sensitive help.

   Since your subscription could potentially have multiple namespaces, please notice that the Device ID template must contain one specific namespace within your subscription.

7. Click the Add button.

As a result, the certificate is stored. Click the name to see the details.

Step B - Configure the Devices via Bosch IoT Hub connection

By default, the "Devices via Bosch IoT Hub" connection was generated automatically at the time of creating all service instances of this service subscription.

This connection provides default templates for creating stand-alone devices as well as gateways or devices which communicate via a gateway.

However, in case the default template does not fit your needs, feel free to customize it.

Step C - Use Eclipse Mosquitto - to simulate a new device that needs to be registered implicitly

• The mosquitto_pub command is installed. See Eclipse Mosquitto.

• Download the server certificate for MQTT TLS encryption.

  curl -o ISRGRootX1.crt https://letsencrypt.org/certs/isrgrootx1.pem

• Send an event from the device to simulate a change.
  In case the device can authenticate properly (i.e. the device-cert is valid within the range of the CA cert which you have uploaded at step A) but does not exist yet, this would result into a new device registration.

• The content of the message must additionally respect the notation of Eclipse Ditto protocol.
  In our example we simulate updating the value if the manufacturer attribute, thus the request body looks like in the following snippet:
  

  mosquitto_pub -h mqtt.bosch-iot-hub.com -p 8883 -t event -m

  '{

  "topic": "<your.namespace>/device-name/things/twin/commands/modify",

  "path": "/attributes/manufacturer",

  "value": "my company"

  }'

  -q 1 --cert demo-certs/certs/device-cert.pem --key demo-certs/certs/device-key.pem --cafile ISRGRootX1.crt

  If your like to reproduce, please replace <your.namespace> in the "topic" part - with exactly the namespace edited at step A, nr 6.

  The device-name will be substituted with the {{subject-cn}} form the device certificate.

Check your work

The mosquitto_pub command is forwarded to Bosch IoT Things, the digital twin layer of Bosch IoT Device Management. Due to the fact that it is passed through the connection configured at step B, a payload mapping will be applied.

The device is automatically created with the respective template - which excludes the attribute.