Certification content: first draft #49
Conversation
First three sections and index are ready for full review (membership, development and self-pre-test). Remaining documentation is placeholders based on the spreadsheet.
|
Preview deployed at https://d2doqw88td69eq.cloudfront.net/pr-49 |
| The certification declaration is provided by the CSA after a device is | ||
| certified. It is tied to the vendor and product ID (or IDs) of the certified | ||
| device, and is signed by CSA. The public key corresponding to the signing key is | ||
| well known and distributed by the CSA (TODO: It shows up everywhere, but where's |
There was a problem hiding this comment.
@jcps07 - do you know where the cert for this key is published officially?
There was a problem hiding this comment.
The Production CD Signing Certs are publicly available in the Distributed Compliance Ledger (DCL) (Main-Net):
CD Signing Certs Root CA:
CD Signing Cert SKIDs:
|
|
||
| ### Matter on-boarding materials (QR codes and manual codes) | ||
|
|
||
| - TODO: need a way to address custom flow and the different requirements for |
There was a problem hiding this comment.
@amolivo - Do you know if there is material that covers this already? The tricky part is that i'm pretty sure this was just wrong in prior revisions of the specification. see https://github.com/CHIP-Specifications/connectedhomeip-spec/pull/10582
|
|
||
| Product manufacturers should be aware that the CSA has a sunset policy in effect | ||
| for prior specification revisions. The sunset policy is available in full at | ||
| (TODO: where's the sunset policy?). |
There was a problem hiding this comment.
@amolivo - this is an SC thing right? Is this actually published anywhere?
| certification planning for the product since all updates need to be | ||
| re-certified. | ||
|
|
||
| [//]: #(TODO: do we want to talk about factory shipping image / 0-day split? |
There was a problem hiding this comment.
Maybe a question for RS re: proposals around OTA during commissioning.
| - add links to the marketing requirements for setup codes | ||
| - additional badging? WW programs? | ||
| ### Works-with programs | ||
| - TODO: is that a universal name? |
|
|
||
| ## Other | ||
|
|
||
| ANN - any other MP TTs that should fall into this bucket? |
|  | ||
|
|
||
| Placeholder with questions: | ||
| - ANN - do you have text around why OTAs and recertification are important |
|
|
||
| Placeholder with questions: | ||
| - ANN - do you have text around why OTAs and recertification are important | ||
| - PETR - does the compatibility matrix cover which ecosystems pick up OTAs from the DCL vs. internal? |
There was a problem hiding this comment.
uh...no idea what Petr's github is, but imagine I tagged him here.
|
|
||
| ## DCL | ||
| - add links to the DCL how-to information | ||
| - still missing - timeline of when updates should happen and a simplified text around who has to make the updates |
There was a problem hiding this comment.
I'd recommend adding a link to the DCL Guide within the Handbook: https://handbook.buildwithmatter.com/guides/distributedcomplianceledger/
Additionally, I have these steps to validate the following FAQ: Why is my product still showing the "not certified" message?
It could be added as a FAQ or as a "Next Steps"...
After a product completes the certification process, verify the following steps:
-
Submit the Model and Model-Version data to the DCL for the Alliance to create its associated Compliance entry in the DCL. Refer to HowTo - Writing to the DCL.pdf
-
After the Compliance entry has been added to the DCL by the Alliance, ensure the following steps are completed for a commissioner to recognize the product as certified:
- The Vendor information is present in the Vendor Info schema in the DCL.
- The firmware's Certification Declaration (CD) and Basic Information Cluster match the information in the DCL 'Model' and 'Model-Version' entries.
- The CD includes the VID and PID used in the Device Attestation Credential (DAC).
- The DACs are properly chained to a PAA approved in the DCL
The final step is to wait for commissioners to update their local DCL image. This process typically takes no longer than 24 hours, though the timing may vary based on each manufacturer's implementation. If the "uncertified device" warning persists after this period, contact the Commissioner's support team to confirm if additional steps are required on their platform.
First three sections and index are ready for full review (membership, development and self-pre-test).
Remaining documentation is placeholders based on the spreadsheet.