Secure wireless zero touch onboarding of computing devices

A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device implementing a control plane configured for onboarding of an endpoint computing device that is to be deployed at a first computing site causes the at least one processing device:

• to obtain a data structure, the obtained data structure comprising information utilizable for generating a temporary wireless credential for the endpoint computing device that is to be deployed at the first computing site, the temporary wireless credential being provisioned in the endpoint computing device at a second computing site different than the first computing site;
• to generate, based at least in part on the obtained data structure, the temporary wireless credential for the endpoint computing device;
• to provision the temporary wireless credential in a wireless network device at the first computing site;
• to verify a wireless connection between the endpoint computing device and the wireless network device at the first computing site, the wireless connection utilizing the temporary wireless credential;
• responsive to successfully verifying the wireless connection of the endpoint computing device to the wireless network device at the first computing site utilizing the temporary wireless credential, to provision an updated wireless credential in the endpoint computing device and the wireless network device, the updated wireless credential being specified by an operator of the first computing site;
• to receive, from the endpoint computing device, a payload comprising the updated wireless credential signed using a private key of a key pair associated with the endpoint computing device;
• to verify the payload received from the endpoint computing device utilizing a public key of the key pair associated with the endpoint computing device;
• and
• responsive to successfully verifying the payload received from the endpoint computing device, to instruct the endpoint computing device to remove the temporary wireless credential provisioned in the endpoint computing device.

A method performed by at least one processing device comprising a processor coupled to a memory, the at least one processing device implementing a control plane configured for onboarding of an endpoint computing device that is to be deployed at a first computing site, the method comprising:

• obtaining a data structure, the obtained data structure comprising information utilizable for generating a temporary wireless credential for the endpoint computing device that is to be deployed at the first computing site, the temporary wireless credential being provisioned in the endpoint computing device at a second computing site different than the first computing site;
• generating, based at least in part on the obtained data structure, the temporary wireless credential for the endpoint computing device;
• provisioning the temporary wireless credential in a wireless network device at the first computing site;
• verifying a wireless connection between the endpoint computing device and the wireless network device at the first computing site, the wireless connection utilizing the temporary wireless credential;
• responsive to successfully verifying the wireless connection of the endpoint computing device to the wireless network device at the first computing site utilizing the temporary wireless credential, provisioning an updated wireless credential in the endpoint computing device and the wireless network device, the updated wireless credential being specified by an operator of the first computing site;
• receiving, from the endpoint computing device, a payload comprising the updated wireless credential signed using a private key of a key pair associated with the endpoint computing device;
• verifying the payload received from the endpoint computing device utilizing a public key of the key pair associated with the endpoint computing device;
• and
• responsive to successfully verifying the payload received from the endpoint computing device, instructing the endpoint computing device to remove the temporary wireless credential provisioned in the endpoint computing device.