c8y(1)

📦 version 2.56.1, in nixpkgs unstable

c8y(1) 💅 — the manual, bestie

NAME 🎀

c8y-devices-enroll — enroll a device using the Cumulocity Certificate Authority

SYNOPSIS ✨

c8y devices enroll [flags]

DESCRIPTION 🦋

okay so this command registers a device using the Cumulocity Certificate Authority, and it keeps trying to download the device’s certificate by submitting a Certificate Signing Request via the EST protocol. It’s giving “persistent bestie” energy — it polls until it gets the cert.

The registration url and QR code get printed on the console so users can register the device via a web browser. Cute, right? 🫶

heads up: this feature requires the feature toggle "certificate-authority" 💖

OPTIONS 💅

--cert="" — path to write the downloaded certificate to
--csr="" — use the given certificate signing request instead of generating one
-d, --data=[] — static data to slap onto the body; accepts json or shorthand json, i.e. --data 'value1=1,my.nested.value=100'
-h, --help[=false] — help for enroll
--host="" — custom Cumulocity host
--id="" — device identifier. Max: 1000 characters. E.g. IMEI. required, and it accepts pipeline
--key="" — device's private certificate; if it doesn’t exist, it will be created
--mode="" — registration mode
--one-time-password="" — One Time Password used for initial enrollment. Leave blank for a randomly generated password
--overwrite[=false] — overwrite any existing device key and certificate
--processingMode="" — Cumulocity processing mode
--retry-every=5s — polling interval to try to download the device certificate
--show-qr[=false] — show QR Code with the registration url
--show-url[=true] — show URL with the registration url
--template="" — body template
--templateVars=[] — body template variables
--type="" — device type to register (only works when pre-registering the device)

OPTIONS INHERITED FROM PARENT COMMANDS 🧬

--abortOnErrors=10 — abort batch when reaching specified number of errors
--allowEmptyPipe[=false] — don't fail when piped input is empty (stdin)
--cache[=false] — enable cached responses
--cacheBodyPaths=[] — cache should limit hashing of selected paths in the json body. Empty indicates all values
--cacheTTL="60s" — cache time-to-live (TTL) as a duration, i.e. 60s, 2m
-c, --compact[=false] — compact instead of pretty-printed output when using json output. Pretty print is the default if output is the terminal
--confirm[=false] — prompt for confirmation
--confirmText="" — custom confirmation text
--currentPage=0 — current page which should be returned
--customQueryParam=[] — add custom URL query parameters. i.e. --customQueryParam 'withCustomOption=true,myOtherOption=myvalue'
--debug[=false] — set very verbose log messages
--delay="0ms" — delay after each request, i.e. 5ms, 1.2s
--delayBefore="0ms" — delay before each request, i.e. 5ms, 1.2s
--dry[=false] — dry run. Don't send any data to the server
--dryFormat="markdown" — dry run output format. i.e. json, dump, markdown or curl
--examples[=false] — show examples for the current command
--filter=[] — apply a client side filter to response before returning it to the user
--flatten[=false] — flatten json output by replacing nested json properties with properties where their names are represented by dot notation
-f, --force[=false] — do not prompt for confirmation. Ignored when using --confirm
-H, --header=[] — custom headers. i.e. --header "Accept: value, AnotherHeader: myvalue"
--includeAll[=false] — include all results by iterating through each page
-k, --insecure[=false] — allow insecure server connections when using SSL
-l, --logMessage="" — add custom message to the activity log
--maxJobs=0 — maximum number of jobs. 0 = unlimited (use with caution!)
--noAccept[=false] — ignore Accept header will remove the Accept header from requests, however PUT and POST requests will only see the effect
--noCache[=false] — force disabling of cached responses (overwrites cache setting)
-M, --noColor[=false] — don't use colors when displaying log entries on the console
--noLog[=false] — disables the activity log for the current command
--noProgress[=false] — disable progress bars
--noProxy[=false] — ignore the proxy settings
-n, --nullInput[=false] — don't read the input (stdin). Useful if using in shell for/while loops
-o, --output="table" — output format i.e. table, json, csv, csvheader
--outputFile="" — save JSON output to file (after select/view)
--outputFileRaw="" — save raw response to file (before select/view)
--outputTemplate="" — jsonnet template to apply to the output
-p, --pageSize=5 — maximum results per page
--progress[=false] — show progress bar. This will also disable any other verbose output
--proxy="" — proxy setting, i.e. http://10.0.0.1:8080
-r, --raw[=false] — show raw response. This mode will force output=json and view=off
--retries=3 — max number of attempts when a failed http call is encountered
--select=[] — comma separated list of properties to return. wildcards and globstar accepted, i.e. --select 'id,name,type,**.serialNumber'
--session="" — session configuration
--sessionMode="" — override default session mode for a single command which would normally be disabled
-P, --sessionPassword="" — override session password
-U, --sessionUsername="" — override session username. i.e. peter or t1234/peter (with tenant)
--silentExit[=false] — silent status codes do not affect the exit code
--silentStatusCodes="" — status codes which will not print out an error message
--timeout="600s" — request timeout duration, i.e. 60s, 2m
--totalPages=0 — total number of pages to get
-v, --verbose[=false] — verbose logging
--view="auto" — use views when displaying data on the terminal. Disable using --view off
--withError[=false] — errors will be printed on stdout instead of stderr
--withTotalElements[=false] — request Cumulocity to include the total elements in the response statistics under .statistics.totalElements (introduced in 10.13)
-t, --withTotalPages[=false] — request Cumulocity to include the total pages in the response statistics under .statistics.totalPages
--workers=1 — number of workers

EXAMPLE 🌈

Enroll a new device with a randomized one-time password:

$ c8y devices enroll --id "ASDF098SD1J10912UD92JDLCNCU8"

Enroll a new device and provide the one-time-password to be used for enrollment:

$ c8y devices enroll --id "ASDF098SD1J10912UD92JDLCNCU8" --one-time-password "RqzwJeTusABlk4)KmtIc"

Enroll a new device and specify a host name so a session does not need to be set:

$ c8y devices enroll --id "ASDF098SD1J10912UD92JDLCNCU8" --host example.cumulocity.com

Enroll a new device and specify the names of the private key and public certificate to use:

$ c8y devices enroll --id "ASDF098SD1J10912UD92JDLCNCU8" --key myname.key --cert myname.crt

Enroll 2 devices and create unique private key and certificate per device:

$ c8y util repeat 3 | c8y devices enroll --template "{id: 'device' + input.index}"

Enroll a device and use the certificate to connect to Cumulocity via MQTT (with mosquitto_sub):

$ DEVICE_ID=example
$ c8y devices enroll --id "$DEVICE_ID"
$ mosquitto_sub --key "${DEVICE_ID}.key" --cert "${DEVICE_ID}.crt" -t 's/ds' -i "$DEVICE_ID" -h $C8Y_DOMAIN -p 8883 --cafile "$(brew --prefix)/etc/ca-certificates/cert.pem" --debug
$ mosquitto_sub --key "${DEVICE_ID}.key" --cert "${DEVICE_ID}.crt" --cafile "$(brew --prefix)/etc/ca-certificates/cert.pem" -i "$DEVICE_ID" -h $C8Y_DOMAIN -p 9883 -t 'custom/topic' --debug