The TLS Certificate Management cluster (0x0801) is a Matter cluster that Manages X.509 trust anchors and device certificates used for TLS outside the Matter fabric (e.g. cloud connectors).. It defines 15 commands and 4 attributes.
TLS Certificate Management 0x0801
Manages X.509 trust anchors and device certificates used for TLS outside the Matter fabric (e.g. cloud connectors).
Spec History
This cluster's ClusterRevision across the Matter releases it has shipped in. Click a version to inspect the cluster as it existed in that release.
Attributes 4
Commands 15
| Code | Name | Type | Flags |
|---|---|---|---|
| 0x0000 |
MaxRootCertificates
5..254
|
int8u | |
| 0x0001 | ProvisionedRootCertificates | array | |
| 0x0002 |
MaxClientCertificates
2..254
|
int8u | |
| 0x0003 | ProvisionedClientCertificates | array |
| Code | Name | Direction | Parameters |
|---|---|---|---|
| 0x00 |
ProvisionRootCertificate
invoke: administer
This command SHALL provision a newly provided certificate, or rotate an existing one, based on the contents of the CAID field.
|
client→server |
Certificate: long_octet_string, CAID: int16u |
| 0x01 |
ProvisionRootCertificateResponse
This command SHALL be generated in response to a ProvisionRootCertificate command.
|
server→client |
CAID: int16u |
| 0x02 |
FindRootCertificate
This command SHALL return the specified TLS root certificate, or all provisioned TLS root certificates for the accessing fabric, based on the contents of the CAID field.
|
client→server |
CAID: int16u |
| 0x03 |
FindRootCertificateResponse
This command SHALL be generated in response to a FindRootCertificate command.
|
server→client |
CertificateDetails: TLSCertStruct |
| 0x04 |
LookupRootCertificate
This command SHALL return the CAID for the passed in fingerprint.
|
client→server |
Fingerprint: octet_string |
| 0x05 |
LookupRootCertificateResponse
This command SHALL be generated in response to a LookupRootCertificate command.
|
server→client |
CAID: int16u |
| 0x06 |
RemoveRootCertificate
invoke: administer
This command SHALL be generated to request the server removes the certificate provisioned to the provided Certificate Authority ID.
|
client→server |
CAID: int16u |
| 0x07 |
ClientCSR
invoke: administer
This command SHALL be generated to request the Node generates a certificate signing request for a new TLS key pair or use an existing CCDID for certificate rotation.
|
client→server |
Nonce: octet_string, CCDID: int16u |
| 0x08 |
ClientCSRResponse
This command SHALL be generated in response to a ClientCSR command.
|
server→client |
CCDID: int16u, CSR: long_octet_string, NonceSignature: octet_string |
| 0x09 |
ProvisionClientCertificate
invoke: administer
This command SHALL be generated to request the Node provisions newly provided Client Certificate Details, or rotate an existing client certificate.
|
client→server |
CCDID: int16u, ClientCertificate: long_octet_string, IntermediateCertificates: octet_string |
| 0x0A |
FindClientCertificate
This command SHALL return the TLSClientCertificateDetailStruct for the passed in CCDID, or all TLS client certificates for the accessing fabric, based on the contents of the CCDID field.
|
client→server |
CCDID: int16u |
| 0x0B |
FindClientCertificateResponse
This command SHALL be generated in response to a FindClientCertificate command.
|
server→client |
CertificateDetails: TLSClientCertificateDetailStruct |
| 0x0C |
LookupClientCertificate
This command SHALL return the CCDID for the passed in Fingerprint.
|
client→server |
Fingerprint: octet_string |
| 0x0D |
LookupClientCertificateResponse
This command SHALL be generated in response to a LookupClientCertificate command.
|
server→client |
CCDID: int16u |
| 0x0E |
RemoveClientCertificate
invoke: administer
This command SHALL be used to request the Node removes all stored information for the provided CCDID.
|
client→server |
CCDID: int16u |
Devices Implementing This Cluster
2 devices in the survey implement this cluster