Devices get their enrollment endpoint and certificate in one of two ways: early binding (baked into the operating system image) or late binding (set at provisioning time).

Early binding: You can build an operating system image that includes the enrollment endpoint and certificate. Devices that use an early binding image can connect to the defined Red Hat Edge Manager service to request enrollment without any additional provisioning configuration.

The devices share the same long-lived X.509 client certificate. However, this binds the devices to a specific service and owner.

Late binding: You can set the enrollment endpoint and certificate at provisioning time instead of including them in the operating system image. Devices that use a late binding image are not tied to a single owner or service and can have per-device, short-lived X.509 client certificates.

However, late binding requires tools that can request per-device enrollment endpoints and certificates from the Red Hat Edge Manager service. The tools inject them into the system by using cloud-init, Ignition, or kickstart.

For factory-imaged physical devices on unmanaged networks, you can use the optional first-boot onboarding wizard. The wizard lets onsite personnel provide per-device network settings and enrollment credentials instead of injecting configuration through cloud-init or Ignition. See Device onboarding at first boot in the Additional resources section.

Note

The enrollment certificate secures only the network link for submitting an enrollment request. It plays no role in verifying or approving the request. After enrollment, devices use per-device management certificates instead.