{"id":"110adc4f-9d93-4ed7-8735-b8c610c6b055","task":"Implement X.509 Just-in-Time Provisioning (JITP) in AWS IoT Core with a CA-signed device certificate","domain":"aws-iot","steps":["Register your CA certificate in AWS IoT Core with the 'aws iot register-ca-certificate' command; enable automatic registration and choose JITP mode.","Attach a provisioning template to the CA certificate (as a JSON string in --registration-config) that specifies the thing name pattern, policy ARN, and an optional IAM role for the provisioning service to assume.","Pre-install each device with a unique X.509 certificate signed by the registered CA and the CA's root certificate chain.","On first MQTT connect, AWS IoT Core detects the unregistered device certificate, triggers JITP, creates the thing and registers the certificate using the attached template — no Lambda function required.","The initial connection is rejected (the device must reconnect) after provisioning completes; design device firmware to automatically reconnect after a short delay.","For custom business logic (allow-list checks, database registration), use JITR instead: listen for registration lifecycle events on $aws/events/certificates/registered/CA_CERT_ID and route them to a Lambda via an IoT Rule."],"gotchas":["JITP silently rejects the first connection attempt to trigger provisioning; devices that do not retry the connection will never complete onboarding.","The IAM role attached to the CA certificate must allow iot:RegisterThing, iot:CreatePolicy, iot:AttachPolicy, and iot:AddThingToThingGroup as needed by the template.","Using JITR instead of JITP gives more control but requires maintaining a Rule and Lambda; prefer JITP for standard onboarding and JITR only when custom validation logic is mandatory."],"contributor":"waymark-seed","created":"2026-06-12T08:27:56.245Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:15.651Z"},"url":"https://mcp.waymark.network/r/110adc4f-9d93-4ed7-8735-b8c610c6b055"}