# Proof of possession fails for trusted certificate **URL:** \ **Category:** Forum\ **Tags:** device-management, device-connectivity\ **Created:** [December 30, 2025, 9:31am UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165 "2025-12-30T09:31:41Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![hariss](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@hariss](https://community.cumulocity.com/u/hariss)\ **Post date:** [December 30, 2025, 9:31am UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/1 "2025-12-30T09:31:41Z")
Hi, I have created a root cert with openssl and a device cert and key signed by the root cert. I then upload the root cert to Cumulocity and try to establish proof of possession but I always fail at that step. I create the signed verification code fine and check for newlines but I always get: **Cannot verify signature for certificate with fingerprint: e9a62fb7e97083b6c and tenant id: t2081875008.** Do I need to establish proof of possession or is that only needed for the bootstrap process? I must be missing something as this is pretty straightforward. Any suggestions? thanks ---
**Author:** ![Kai\_Reinhardt](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/kai_reinhardt/32/18493_2.png) [@Kai\_Reinhardt](https://community.cumulocity.com/u/Kai_Reinhardt)\ **Post date:** [January 13, 2026, 12:29pm UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/2 "2026-01-13T12:29:01Z")
> [@hariss](#): > > proof of possession Hi Hariss at which process step [Device certificates - Cumulocity documentation](https://cumulocity.com/docs/device-certificate-authentication/device-certificates/#creating-an-intermediate-certificate) you fail? Regards Kai ---
**Author:** ![hariss](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@hariss](https://community.cumulocity.com/u/hariss)\ **Post date:** [January 13, 2026, 1:29pm UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/3 "2026-01-13T13:29:56Z")
Hello, I followed the guide closely and I get stuck here [Device certificates - Cumulocity documentation](https://cumulocity.com/docs/device-certificate-authentication/device-certificates/#perform-a-proof-of-possession) with the above error I mentioned. As I understand it, performing proof of possession is necessary for connection to be established. thanks ---
**Author:** ![Kai\_Reinhardt](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/kai_reinhardt/32/18493_2.png) [@Kai\_Reinhardt](https://community.cumulocity.com/u/Kai_Reinhardt)\ **Post date:** [January 15, 2026, 8:10am UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/4 "2026-01-15T08:10:03Z")
Hi harris have you tried again? As far as I know has one colleages have activated a CA on your tenant, Kai ---
**Author:** ![hariss](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@hariss](https://community.cumulocity.com/u/hariss)\ **Post date:** [January 16, 2026, 11:54am UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/5 "2026-01-16T11:54:57Z")
Hello, I have tried multiple times. I create certificates based on your guide and then try to connect both with my device and with a leshan java client. Both error out. I am also unable to succeed in the proof of possession part.. I am not sure what exactly would be helpful for you to know regarding my setup. Please ask away. Is there an instance where I could test my device against Cumulocity? Meaning, could you provide me with working certificates (you can send me via pm if possible) so I can reliably test my setup? thanks ---
**Author:** ![Christian\_Jeuthe](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/christian_jeuthe/32/11057_2.png) [@Christian\_Jeuthe](https://community.cumulocity.com/u/Christian_Jeuthe)\ **Post date:** [January 19, 2026, 10:53am UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/6 "2026-01-19T10:53:53Z")
Dear Hariss, I have enabled the new CA Feature on your partner tenant and created a Root CA. This way there is no proof of possession possible as Cumulocity itself created it. The device can now request to receive a device certificate from the platform. I know this is an alternative process to providing the root CA from an external source but this approach is also an important scenario which is practically relevant if the customer uses the CA feature of Cumulocity. BR, Christian ---
**Author:** ![Christian\_Herzog](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/christian_herzog/32/32209_2.png) [@Christian\_Herzog](https://community.cumulocity.com/u/Christian_Herzog)\ **Post date:** [January 19, 2026, 11:32am UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/7 "2026-01-19T11:32:41Z")
Hello, here is Christian from Cumulocity Support team and I will try to solve this issue on a voluntary basis. First some hints to “proof of possession” (PoP): The core reason for it is, that Cumulocity must be sure that the tenant which uploads a certificate actually owns the private key for that certificate. A certificate chain works also without PoP, if no DOS scenario appears. DOS = Denial-of-Service Attack, see e.g. [All You Need to Know about Denial-of-Service Attack](https://www.appviewx.com/blogs/all-you-need-to-know-about-denial-of-service-attack/) To your issue: First I will check if PoP works in general in the environment you use. Then I will check the certificates in your client. Therefore my questions: 1. In which tenant do you try it? 2. For which certificate? Kind regards, Christian ---
**Author:** ![hariss](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@hariss](https://community.cumulocity.com/u/hariss)\ **Post date:** [January 20, 2026, 8:52am UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/9 "2026-01-20T08:52:08Z")
Hi, I would like to make it work with providing my own root ca, therefore PoP is important to get right. Here are the commands that I use to create the root and then sign the device cert as well ass perform proof of possession: > haris@hak:~$ openssl genrsa -aes256 -out rootCA.key 4096 > Enter PEM pass phrase: > Verifying - Enter PEM pass phrase: > haris@hak:~$ openssl req -new -x509 -days 3650 -key rootCA.key -sha256 -extensions v3\_ca -out rootCA.pem -subj “/C=US/ST=State/L=City/O=Organization/OU=OrgUnit/CN=RootCA” -addext “basicConstraints=critical,CA:TRUE” -addext “keyUsage=critical,digitalSignature,cRLSign,keyCertSign” > Enter pass phrase for rootCA.key: > haris@hak:~$ openssl genrsa -aes256 -out device.key 4096 > Enter PEM pass phrase: > Verifying - Enter PEM pass phrase: > haris@hak:~$ openssl req -new -key device.key -out device.csr -subj “/C=US/ST=State/L=City/O=Organization/OU=OrgUnit/CN=ADS700” > Enter pass phrase for device.key: > haris@hak:~$ openssl x509 -req -in device.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out device.pem -days 365 -sha256 -extfile \<(echo “basicConstraints=critical,CA:FALSE > keyUsage=critical,nonRepudiation,digitalSignature,keyEncipherment”) > Certificate request self-signature ok > subject=C = US, ST = State, L = City, O = Organization, OU = OrgUnit, CN = ADS700 > Enter pass phrase for rootCA.key: > haris@hak:~$ cat device.pem rootCA.pem \> deviceChain.pem > haris@hak:~$ openssl verify -CAfile rootCA.pem device.pem > device.pem: OK > haris@hak:~$ openssl dgst -sha256 -sign rootCA.key verification\_code.txt | openssl base64 -A \> signed\_verification.txt > Enter pass phrase for rootCA.key: Hope the above clears some stuff up. I am using my company’s tenant and the certificate that I create with the above. Thanks ---
**Author:** ![Christian\_Herzog](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/christian_herzog/32/32209_2.png) [@Christian\_Herzog](https://community.cumulocity.com/u/Christian_Herzog)\ **Post date:** [January 20, 2026, 10:14am UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/10 "2026-01-20T10:14:28Z")
Hello hariss, in the meantime I tested the proof of possession in my test tenant on [eu-latest.cumulocity.com](http://eu-latest.cumulocity.com), it works. I encrypt the verification code using the private key of the certificate to produce the signed verification code. For it I use the following OpenSSL command: - openssl dgst -sha256 -sign \ \ | openssl base64 -A - E.g. openssl dgst -sha256 -sign “G:\My Drive...\CHH2\_CA\CHH2\_CA.key” “C:...\CHH2\_CA.txt” | openssl base64 -A The private key file “CHH2\_CA.key” should contain text like this: -----BEGIN EC PRIVATE KEY----- MHcC… …aEuw== -----END EC PRIVATE KEY----- And the verification\_code.txt is downloaded from [Device Management](https://devicecertification-indinf.eu-latest.cumulocity.com/apps/devicemanagement/index.html#/trusted-certificates/certificates) - rootca - field “Verification code” I have support access on your tenant and all what I see in your tenant is fine. Please try my “openssl dgst…” command and let me know the result. If you don’t have success, then I will try to reproduce your complete procedure. Regards, Christian ---
**Author:** ![hariss](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@hariss](https://community.cumulocity.com/u/hariss)\ **Post date:** [January 20, 2026, 10:24am UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/11 "2026-01-20T10:24:37Z")
Hello Christian, I followed your suggestion and I get the same result: haris@hak:~/certs$ openssl dgst -sha256 -sign rootCA.key verification\_code.txt | openssl base64 -A Enter pass phrase for rootCA.key: R39xe5kgN4AvuAB5RSJp5KCHIOKqqFNlPm7+djaIwNFhfHSQTQ4zSSqOqyRRFkQaDFEDeBlxvtzd11/QNWLVcd2S1XLu051QV8nYxXm4o9gnepORcCnsToijKks6s4GezGJFWPcI0C5TS9FzGhnl7rfkoW+wRnjqpZpVz1nfVKcTticsamnLZG9jGYZ+Z3uLrFI3IVZYs5BakzkbMJYJpg5VMsNljFkztFS0Gn0LzBH6ki7NfaqE8cXCALM7c9s9u8eLe3eMe4LQEkCaC8vjwJt3vkGPLaUohXGBi6XE0cQTCu23VFpE3gDUDIwYtOD+W0AOs5WKK6fiTO0+ Result: **Cannot verify signature for certificate with fingerprint: 6db6fcf0b1ed6463781e6cc498fffb148dea3f05 and tenant id: t2081875008.** ---
**Author:** ![Christian\_Herzog](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/christian_herzog/32/32209_2.png) [@Christian\_Herzog](https://community.cumulocity.com/u/Christian_Herzog)\ **Post date:** [January 20, 2026, 1:48pm UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/12 "2026-01-20T13:48:04Z")
Hello hariss, your steps are correct. I followed them and finished my POP successful. So far I have no idea why it fails on your site. I will discuss your issue with our R&D and come back here. Regards, Christian ---
**Author:** ![Christian\_Herzog](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/christian_herzog/32/32209_2.png) [@Christian\_Herzog](https://community.cumulocity.com/u/Christian_Herzog)\ **Post date:** [January 22, 2026, 2:37pm UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/13 "2026-01-22T14:37:58Z")
Hello hariss, please contact me by email christian.herzog@cumulocity privately. Regards, Christian ---
**Author:** ![Christian\_Herzog](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/christian_herzog/32/32209_2.png) [@Christian\_Herzog](https://community.cumulocity.com/u/Christian_Herzog)\ **Post date:** [January 29, 2026, 2:30pm UTC](https://community.cumulocity.com/t/proof-of-possession-fails-for-trusted-certificate/14165/14 "2026-01-29T14:30:55Z")
Here an example procedure to create an own certificate and to complete the proof of possession: (Environment: Windows 11 PC) - Create folder: "C:\certificates\CA13” - Open Git Bash - cd “C:\certificates\CA13” - command WSL (this starts the Windows Subsystem for Linux) - openssl genrsa -aes256 -out rootCA13.key - Enter PEM pass phrase: summer007 - Verifying - Enter PEM pass phrase: summer007 - Result: rootCA13.key - openssl req -new -x509 -days 3650 -key rootCA13.key -sha256 -extensions v3\_ca -out rootCA13.pem -subj “/C=US/ST=State/L=City/O=Organization/OU=OrgUnit/CN=RootCA” -addext “basicConstraints=critical,CA:TRUE” -addext “keyUsage=critical,digitalSignature,cRLSign,keyCertSign” - Enter pass phrase for rootCA.key: summer007 - Result: rootCA13.pem - openssl genrsa -aes256 -out device13.key - Enter PEM pass phrase: summer007 - Verifying - Enter PEM pass phrase: summer007 - Result: device13.key - openssl req -new -key device13.key -out device13.csr -subj “/C=US/ST=State/L=City/O=Organization/OU=OrgUnit/CN=ADS700” - Enter pass phrase for device13.key: summer007 - Result: device13.csr - openssl x509 -req -in device13.csr -CA rootCA13.pem -CAkey rootCA13.key -CAcreateserial -out device13.pem -days 365 -sha256 -extfile \<(echo “basicConstraints=critical,CA:FALSE keyUsage=critical,nonRepudiation,digitalSignature,keyEncipherment”) - Output: - Certificate request self-signature ok - subject=C = US, ST = State, L = City, O = Organization, OU = OrgUnit, CN = ADS700 - Enter pass phrase for rootCA13.key: summer007 - Result: device13.pem (customer: ADS700.pem) - cat device13.pem rootCA13.pem \> deviceChain13.pem - Result: deviceChain13.pem - openssl verify -CAfile rootCA13.pem device13.pem - Output: device13.pem: OK - Open {your tenant}/apps/devicemanagement/index.html#/trusted-certificates/certificates - Add trusted certificate - Name and file “rootCA13.pem” - Enable “Auto registration” - Enable - Download Verification code → file name “rootCA13.pem.txt” - Move it to C:\certificates\CA13 - openssl dgst -sha256 -sign rootCA13.key “rootCA13.pem.txt” | openssl base64 -A \> signed\_verification.txt - Enter pass phrase for device.key: summer007 - File “signed\_verification.txt” shows “aDNSzl\*\*\*0Wr312Q==” Enter this into “Signed verification code” → Verify → Success