NM-SCCM-A: BACnet Secure Connect Certificate Management

Reference for the NM-SCCM-A BIBB: provisioning and rotating BACnet Secure Connect device certificates over standard BACnet services

What NM-SCCM-A Is

NM-SCCM-A (Network Management-Secure Connect Certificate Management-A) is the BACnet Interoperability Building Block (BIBB) for the tool side of certificate management in a BACnet Secure Connect network. A device claiming NM-SCCM-A can provision and rotate the X.509 certificates on BACnet SC nodes using standard BACnet services rather than a vendor-specific utility.

How Certificate Management Works

BACnet SC deliberately reuses existing BACnet plumbing for certificate operations instead of inventing a new management protocol.

StepBACnet Service UsedPurpose
Read certificate stateReadProperty on the device’s Network Port propertiesConfirm which certificates a node currently holds
Collect the signing requestAtomic file services (AtomicReadFile)The device generates its own key pair and exposes the CSR through Certificate_Signing_Request_File; read it out for the site CA to sign
Stage new certificatesAtomic file services (AtomicWriteFile)Transfer the signed operational certificate and the issuer certificates to the device
Update bindingsWritePropertyPoint the BACnet SC network port at the staged credentials
ActivateReinitializeDeviceRestart the datalink so the node reconnects with its new identity

The signing-request step is the one to design around. When the device generates its own key pair and emits a CSR, the private key never leaves the controller, and rotation becomes a procedure you can run over the network instead of a key-handling exercise. A device that cannot generate its own CSR forces you to create keys elsewhere and ship them to the device, which is the part a security reviewer will object to.

Why It Matters in the Field

An expired certificate is a node the tool can no longer reach over BACnet SC, which is why rotation has to complete before expiry, not after. Whether it is a scripted, on-line procedure or a visit to every controller depends on the devices a tool has to drive. Planning that across a building’s life is a separate exercise: see BACnet SC Certificate Lifecycle for issuance, rotation, revocation, and CA rollover.

What Chipkin Provides

The CAS BACnet Stack is on the device side of this BIBB. It implements the ReadProperty, WriteProperty, AtomicReadFile, AtomicWriteFile, and ReinitializeDevice plumbing an NM-SCCM-A tool drives, so a stack-based device answers a provisioning tool rather than claiming the BIBB itself. That device-side behavior is not yet BTL-verified. The CAS BACnet Stack 6.x release adds certificate-rotation tooling for provisioning and rotating a fleet on-line, aimed at deployments that have to run for decades. The per-device plumbing a tool drives is in the shipping stack; what 6.x adds is the tool.