Centrally managed PKI provisioning and rotation

A system comprising:

• one or more processors;
• and
• memory configured to store instructions, the instructions, when executed by the one or more processors, cause the one or more processors to:
• receive, from a provisioning device physically connected to a configurable device, a request for a cryptographic keypair, the request indicative of an identity record of the provisioning device;
• generate the cryptographic keypair, the cryptographic keypair comprising a private key and a public key, the cryptographic keypair generated in response to the request;
• verify the identity record of the provisioning device;
• encrypt the private key with a provisioning device public key to generate an encrypted private key, the provisioning device public key corresponding to a provisioning device private key held by the provisioning device;
• and
• transmit a response of the request to the provisioning device, the response comprising the encrypted private key for the provisioning device to decrypt using the provisioning device private key and to transfer the private key to the configurable device to generate a provisioned named entity device, the provisioned named entity device associated with an identity record comprising the public key hosted at a namespace server.

A non-transitory computer readable storage medium configured to store computer code comprising instructions, the instructions, when executed by one or more processors, cause the one or more processors to:

• receive, from a provisioning device physically connected to a configurable device, a request for a cryptographic keypair, the request indicative of an identity record of the provisioning device;
• generate the cryptographic keypair, the cryptographic keypair comprising a private key and a public key, the cryptographic keypair generated in response to the request;
• verify the identity record of the provisioning device;
• encrypt the private key with a provisioning device public key to generate an encrypted private key, the provisioning device public key corresponding to a provisioning device private key held by the provisioning device;
• and
• transmit a response of the request to the provisioning device, the response comprising the encrypted private key for the provisioning device to decrypt using the provisioning device private key and to transfer the private key to the configurable device to generate a provisioned named entity device, the provisioned named entity device associated with an identity record comprising the public key hosted at a namespace server.