Icon Labs Partners with Infineon to Provide a Complete PKI Management Solution for the OPTIGA™ TPM

IoT device manufacturers can now manage PKI certificates throughout the product lifecycle

May 3rd 2017 Tamworth, Staffs and West Des Moines, Iowa Icon Labs ( a leading provider of security solutions for IoT and edge devices, today announced its IoT Certificate management solution supports Infineon Technologies’ OPTIGA™ Trusted Platform Module (TPM). The partnership enables device manufacturers to manage PKI (Public Key Infrastructure) certificates throughout the product lifecycle using the OPTIGA™ TPM, including support for certificate injection during device manufacturing. Instead of having to manually install a certificate into each device, the device comes off the assembly line with a PKI certificate already installed. Infineon`s OPTIGA™ TPM chip complies with the internationally recognized security standards of the Trusted Computing Group (TCG). Infineon is recognized as the world’s leading supplier of security solutions for Trusted Computing.

Security is a critical requirement for the IoT, and strong device authentication, using widely adopted PKI technology, enables managed security solutions for IoT deployments. Icon Labs’ Floodgate Certificate Authority (CA) and Floodgate PKI Client allow manufacturers to incorporate certificate-based authentication using the OPTIGA™ TPM for secure key storage. Capabilities include certificate creation during the manufacturing process using private keys stored in the TPM, certificate creation during device provisioning, and certificate management throughout the life of the device.

Icon Labs provides both the client- and server-sides of the PKI solution required to automate secure provisioning and enrollment. The Floodgate PKI Client is compatible with public and private CAs, providing the flexibility to operate a private PKI system without dependence on a public CA or to operate within the hierarchy of a public CA. The OPTIGA™ TPM securely stores the keys, the Floodgate Factory CA Server creates device authentication certificates, and the Floodgate PKI Client enables a connection in the field to a CA for issuance of TLS and other run-time certificates. The certificates create a Root of Trust enabling secure machine-to-machine communications, using keys secured by the OPTIGA™ TPM.

“Icon Labs’ solution solves two main security challenges for the IoT,” said Steve Hanna, Sr. Principal for Technical Marketing, of Infineon. “OEMs can easily create certificates for devices using the OPTIGA™ TPM for secured key storage, and, by automating the process, provide the scalability required as the number of IoT devices grows into the billions.”

“We are excited to partner with Infineon to provide a complete PKI solution for OEMs using the OPTIGA™ TPM. The Floodgate Factory CA Server enables certificate signing during manufacturing,” said Alan Grau, President of Icon Labs. “The Floodgate PKI Client provides the device-side software to streamline TPM usage and key storage, while the Floodgate CA Server allows management of Public Key Infrastructure (PKI) certificates after the device is deployed.”

How Does the Solution Work?

Creating a signed certificate during manufacturing requires several steps. First, the Floodgate PKI Client requests the OPTIGA™ TPM to generate a new public-private key pair. Using this key pair, a certificate signing request (CSR) is created while the private key does not leave the TPM. The Floodgate PKI Client sends the CSR to the Factory CA Server, which signs the request and returns a signed certificate to the PKI Client. This certificate can then be used to authenticate the device when the device is provisioned in the field. Follow this link for more information: Automated certificate insertion for OPTIGA™ TPM

More about Icon Labs

Icon Labs, a 2014 Gartner “Cool Vendor” and 2015 Gartner “Select Vendor”, is a leading provider of embedded software for device security, device protection, and networking management. They are known for their award-winning Floodgate Defender and Floodgate Security Framework products. The Floodgate Certificate Authority (CA) and Public Key Infrastructure (PKI) Client offer manufacturers easy and efficient integration of certificate-based machine-to-machine authentication. Founded in 1992, Icon Labs is headquartered in West Des Moines, Iowa, USA

In the UK Icon Labs is distributed by Phaedrus Systems (

About Infineon

Infineon Technologies AG is a world leader in semiconductor solutions that make life easier, safer and greener. Microelectronics from Infineon is the key to a better future. In the 2016 fiscal year (ending September 30), the company reported sales of about Euro 6.5 billion with more than 36,000 employees worldwide. Infineon is listed on the Frankfurt Stock Exchange (ticker symbol: IFX) and in the USA on the over-the-counter market OTCQX International Premier (ticker symbol: IFNNY).

More information can be found at

About Phaedrus Systems

Phaedrus Systems is the UK’s leading specialist in the support of engineers at all stages of embedded safety-critical and high-integrity projects. Tools available include requirements capture for IEC 61508, EN 50128 and nuclear applications; requirements tracking and competency tools; estimation software; SIL3 RTOS; hi-rel embedded database; compiler validation reports and reliability/failure software. Consultants have experience working on automotive, rail and aerospace applications, meeting standards such as IEC 61508 SIL4, and D0178B. Backing these is a wide range of other relevant embedded tools. Phaedrus Systems is based in Tamworth, Staffordshire. More information is available on the website

Company Contacts

Phaedrus Systems

Chris Hills, CTO

Tel: +44 (0) 1827 259546

E-Mail: