A vehicle rolling off an assembly plant requires dozens of cryptographic certificates: one for cellular telematics, one for diagnostics over IP (DoIP), multiple for V2X safety messaging, and one for electric vehicle supply equipment (EVSE) charging. As certificates expire every 12 to 36 months, forcing owners to bring cars to dealerships for manual key re-flashing is financially catastrophic. In this article, we explain how to automate the entire certificate lifecycle over cellular networks.
Private cryptographic keys must never leave the silicon boundary of the HSM—not even during certificate renewals. When a certificate approaches expiration, the HSM's internal TRNG generates a new ECC secp256r1 or Brainpool keypair directly in secure memory. The HSM formats a PKCS#10 Certificate Signing Request (CSR), signs the CSR with the newly minted private key, and passes only the public CSR to the EST daemon. The private key remains permanently sealed in hardware.