title: How to embed AWS Just In Time Provisioning (JITP) into your microcontroller (running Freertos)
body: <p>I'm trying to get an application running in amazon freertos that uses the just in time provisioning mechanism to allow provisioning of a fleet of devices.  </p>
  
  <p>I have run through the steps to <a href="https://docs.aws.amazon.com/freertos/latest/userguide/getting_started_espressif.html" rel="nofollow noreferrer">set up a demo application in freertos</a> for an Espressif ESP32 device. This works fine, but it involves effectively manually copying in your credentials directly into the source code, in one of the scripts you run. Good proof of concept, but no good for production. </p>
  
  <p>I have separately run through the process of <a href="https://aws.amazon.com/blogs/iot/setting-up-just-in-time-provisioning-with-aws-iot-core/" rel="nofollow noreferrer">setting up JITP</a> in the AWS backend. The last step is to manually invoke mosquitto from bash to send up a fake message, mimicking an MQTT transmission from a device. </p>
  
  <p>This has the effect of correctly provisioning a device. </p>
  
  <p>My question is how do I take these building blocks and build multiple hardware devices and have them all provision and connect successfully to AWS IOT. </p>
  
  <p>Some specific points:
  1. What files go into the device firmware? I confess a lack of expertise in the crypto and certificates side. My guess would be I need to put root.cert; deviceVertAndCACert.crt; deviceCert.key into the device and ping the MQTT request exactly as per the fake message. But how does this vary for multiple devices? What distinguishes one device from another?</p>
  
  <ol start="2">
  <li><p>I assume the actual code in the hardware device is the same for all devices. Is this assumption valid?</p></li>
  <li><p>If I succeed in provisioning a large number of devices, how do I handle the incoming data stream in AWS IOT. I would envisage invoking a rule to handle the incoming messages.   </p></li>
  </ol>
  
  <p>Mosquitto fake message: </p>
  
  <pre class="lang-sh prettyprint-override"><code>$ mosquitto_pub --cafile root.cert --cert deviceCertAndCACert.crt --key deviceCert.key -h &lt;prefix&gt;.iot.us-east-1.amazonaws.com -p 8883 -q 1 -t foo/bar -I anyclientID --tls-version tlsv1.2 -m "Hello" -d
  </code></pre>