What NM-SCCM-A Is
NM-SCCM-A (Network Management-Secure Connect Certificate Management-A) is the BACnet Interoperability Building Block (BIBB) for the tool side of certificate management in a BACnet Secure Connect network. A device claiming NM-SCCM-A can provision and rotate the X.509 certificates on BACnet SC nodes using standard BACnet services rather than a vendor-specific utility.
How Certificate Management Works
BACnet SC deliberately reuses existing BACnet plumbing for certificate operations instead of inventing a new management protocol.
| Step | BACnet Service Used | Purpose |
|---|---|---|
| Read certificate state | ReadProperty on the device’s Network Port properties | Confirm which certificates a node currently holds |
| Collect the signing request | Atomic file services (AtomicReadFile) | The device generates its own key pair and exposes the CSR through Certificate_Signing_Request_File; read it out for the site CA to sign |
| Stage new certificates | Atomic file services (AtomicWriteFile) | Transfer the signed operational certificate and the issuer certificates to the device |
| Update bindings | WriteProperty | Point the BACnet SC network port at the staged credentials |
| Activate | ReinitializeDevice | Restart the datalink so the node reconnects with its new identity |
The signing-request step is the one to design around. When the device generates its own key pair and emits a CSR, the private key never leaves the controller, and rotation becomes a procedure you can run over the network instead of a key-handling exercise. A device that cannot generate its own CSR forces you to create keys elsewhere and ship them to the device, which is the part a security reviewer will object to.
Why It Matters in the Field
An expired certificate is a node the tool can no longer reach over BACnet SC, which is why rotation has to complete before expiry, not after. Whether it is a scripted, on-line procedure or a visit to every controller depends on the devices a tool has to drive. Planning that across a building’s life is a separate exercise: see BACnet SC Certificate Lifecycle for issuance, rotation, revocation, and CA rollover.
What Chipkin Provides
The CAS BACnet Stack is on the device side of this BIBB. It implements the ReadProperty, WriteProperty, AtomicReadFile, AtomicWriteFile, and ReinitializeDevice plumbing an NM-SCCM-A tool drives, so a stack-based device answers a provisioning tool rather than claiming the BIBB itself. That device-side behavior is not yet BTL-verified. The CAS BACnet Stack 6.x release adds certificate-rotation tooling for provisioning and rotating a fleet on-line, aimed at deployments that have to run for decades. The per-device plumbing a tool drives is in the shipping stack; what 6.x adds is the tool.
Related Pages
- BACnet Secure Connect (BACnet SC)
- NM-SCH-B: Secure Connect Hub
- NM-SCDC-B: Secure Connect Direct Connect
- BACnet
- BACnet SC in the CAS BACnet Stack: what ships today and what 6.x adds
- BACnet SC Certificate Lifecycle: Planning for a 20-Year Building: issuance, distribution, rotation, revocation