Posted On: Nov 10, 2022
AWS IoT Device Defender, a fully managed service for auditing and monitoring devices connected to AWS IoT, now supports a new audit check for revoked intermediate Certificate Authority (CA). If a CA revokes an intermediate CA because it is potentially compromised, then all certificates issued by that intermediate CA are also potentially compromised and invalid. This new audit check identifies active device certificates issued by a revoked intermediate CA, and helps customers review and replace these active device certificates.
To use this feature, you can enable the new audit check in the Device Defender audit section. If you have not enabled Device Defender audit, you can do it with one-click on Device Defender to help secure your IoT devices. If the CA certificates have an issuer endpoint declared in X.509 extension, this audit check identifies the revoked intermediate CAs and reports the active device certificates issued by them. You can disable the compromised device certificate using a pre-built mitigation action or initiate a custom mitigation through a Lambda function. More documentation for Device Defender audit CA check can be found here. This feature is available in all regions where AWS IoT Device Defender is available.