---
title: How to provide your own Certificate Authority
description: This page explains how to provide your own Certificate Authority
tags: iot-hub iot certificate authority certificate-authority
dates:
  validation: 2025-07-16
  validation_frequency: 12
  posted: 2019-09-01
---
import Requirements from '@macros/iam/requirements.mdx'


When creating a hub, a Certificate Authority will be automatically created and a certificate will be issued for each device subsequently added. However, you can opt for the hub to use a custom **Certificate Authority** (CA), to enable more complex scenarios.

<Message type="important">
  - If the hub's Certificate Authority (CA) is changed to a custom one, this action is definitive. It is not possible to reinstate the original Scaleway-managed PKI at a later point.
  - If a hub has devices, their certificates will be deleted. This means that to connect again using mTLS, new certificates must be generated for each device, and signed by the provided Certificate Authority.
</Message>

When using a custom Certificate Authority, devices must present the whole certificate chain, including the Certificate Authority. Failing to present the complete chain will result in a disconnection during the `TLS` handshake. Devices are identified by the **Common Name** (CN) taken from the device certificate. If a device with the same name does not exist inside the target hub, it will be disconnected unless device auto-provisioning is configured (see the next section).

Switching to a custom Certificate Authority has several benefits:

- More flexibility, allowing different key sizes and algorithms.
- It enables industrial usage.

<Message type="note">
  As a security measure to protect certificates, Scaleway does not have access to private keys of custom Certificate Authorities. Therefore, the hub will not issue certificates for a custom Certificate Authority.
</Message>

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- [Created an IoT Hub](/iot-hub/how-to/create-hub/)

<Message type="important">
  To change your hub Certificate Authority, you must [disable your hub](/iot-hub/how-to/enable-disable-hub/).
</Message>

1. Click **IoT Hub** in the **Integration Services** section of the side menu. The list of your IoT Hubs displays.
2. Click the name of the IoT Hub on which the Certificate Authority should be installed. The hub's overview page displays.
3. Prepare the **CA certificate** and a **proof of possession** certificate.

    A proof of possession is needed to prove that you own that Certificate Authority and possess its private key, without sending the private key over the network. This helps to protect the CA certificate from being reused by malicious actors after a hub has been deleted, as certificates alone are public by nature.
    To **generate** a proof of possession, **sign** a certificate that has the target **Hub ID** (that looks like `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`) as **Common Name** using the CA certificate.
4. Scroll to the **Add a Certificate Authority** section of the page. Then click **Replace Certificate Authority**.
5. Upload your CA certificate `pem` file and your verification (proof of possession) certificate `pem` file.
6. Click **Replace certificate authority** to complete the replacement.
7. Re-enable your hub to activate the replaced Certificate Authority.
    <Message type="important">
      Once the CA is uploaded, all existing devices will have their **Scaleway certificates deleted**, as they will not match the newly installed Certificate Authority. You will need to generate new certificates on your side to be able to connect your devices again.
    </Message>