Does Mender Gateway support certificate chain validation with Intermediate CAs for mTLS?

General Discussions
1

Hi,

We are designing a device authorization model for our IoT fleet using mTLS with Mender Gateway (Enterprise). We want to implement a two-level CA hierarchy:

Root CA (stored in HSM, long-lived)
└── Intermediate CA (couple of years validity)
└── Device Certificates (signed by Intermediate CA)

The goal is to:

  • Keep the Root CA secure and rarely used (only to sign Intermediate CAs)
  • Use the Intermediate CA to sign device certificates
  • Enable Intermediate CA rotation without reconfiguring Mender Gateway
  • Allow recovery from Intermediate CA compromise without full PKI rebuild

Our question:

Does Mender Gateway support validating a certificate chain where the device certificate is signed by an Intermediate CA, which is itself signed by the Root CA?

Specifically:

  1. If we configure MTLS_CA_CERTIFICATE with the Root CA, will Mender Gateway validate the full chain (Device cert → Intermediate CA → Root CA)?
  2. Or do we need to provide a CA bundle (concatenated Root CA + Intermediate CA certificates)?
  3. Is there any documentation on certificate chain validation for mTLS?

We reviewed the following documentation but couldn’t find explicit information about Intermediate CA support or certificate chain validation:

Thanks in advance for any guidance.

2

Hi @marifante ,

while the Mender Gateway is configured with the Root CA only, you can add the rest of the CA Chain in the device itself: this means chaining together the Intermediate CA and the Device cert in the /data/mender/mender-cert.pem; this way you should be able to get proper device authorization, and also ease the Intermediate CA rotation: you just have to create a regular Mender update to send the new Intermediate CA and client cert to the device.

3

Thanks Rob! That information is really helpful. We’ll try this setup :slight_smile: