Enrolling XoTs

Before an XoT may be used (and configured as either an XoT-Lock or XoT-Bridge) it has to first find an XoT Managment System (XMS) through a process called discovery and then an enrollment must be performed by a user with access to the XMS in question.

If you have received XoT-S1s or have a software XoT installed by Xertified or a Xertified partner, it is most likely already configured to contact the correct XMS. If not, please contact your Xertified partner or Xertified directly.

If an XoT is configured to contact the correct XMS installation you may proceed with either factory reset or enrollment:

• If you have a newly installed XoT or a previously unused XoT-S1 you can proceed to the enrollment directly.
• If your XoT is already enrolled in an XMS and you would like to either move it to a different system or re-enroll it, then first perform a factory reset.

XMS Discovery

Discovery is a process through which an unenrolled XoT finds which XMS it should contact and prepare for enrollment to. An unenrolled XoT will try to contact https://discovery.prod.xertified.net and if its MAC-address is configured in the service it will then receive an URL to its XMS, which it will then contact to start the enrollment process.

If you are setting up an air-gapped or other such system that may not rely on Xertified's public discovery service you may use something called local discovery.

Local Discovery

Every XMS installation comes with a local discovery service that enables enrollment of XoTs without contacting the public discovery service. To use this feature, simply override the DNS record for discovery.prod.xertified.net, in the DNS used by the XoTs, to point to your XMS installation. The XMS will, when contacted by the XoT, send a discovery reply to the XoT with its own URL. After this the XoT should contact the XMS again to set up for enrollment.

XoT Factory Reset

Factory reset of a Software XoT

If you have an XoT installed on a Linux system first login to the system, and do the following:

systemctl stop xotd
rm -rf /xotd/data/* /xotd/tmp/*
systemctl start xotd

Once the xotd service starts you should be able to proceed to enrollment.

Factory reset of an XoT-S1

1. Press the factory reset button
2. Make sure the XoT-S1 is powered up, and that it is not performing a firmware upgrade.
3. Find the RESET button on the back the XoT-S1.
4. Press the button gently and you can feel and hear a click. Now hold the RESET button until the screen goes black, which takes 5 seconds. Release the button and wait for the screen to come back.
5. The screen should come back after about 30 seconds after it went black.
6. The XoT has now done a factory reset.
7. Clean the XMS from XoT-S1 details
8. Login to the XMS and look up the Device and XoT.
9. Go to the device page and delete the device and XoT.
10. You may now enroll the XoT-S1.
11. See the enrollment section.

Clearing DHCP settings from an XoT-S1

If the reset button is held for over one second, but less than the 5 needed to perform a factory-reset, the S1 will clear any existing DHCP leases and drop any related settings (IP configuration / DHCP options). This can be useful if the S1 is moved to a different network but still has a valid DHCP lease.

XoT Enrollment

The enrollment process can be summarized as follows:

1. Retrieve the enrollment URL and navigate to the XMS.
2. Login to the XMS with an admin user.
3. Follow the enrollment instructions.

How you retrieve the enrollment URL differs depending on if you are enrolling an XoT-S1 or a Software XoT, but the subsequent process is the same.

Every XoT that contacts the XMS also appears on the Pending Enrollments page. Enrolling from that page is an alternative to opening each XoT's enrollment URL, and lets you enroll several XoTs at once.

Getting enrollment URL from XoT-S1

1. Connect a power source to the XoT-S1 via the USB-C port.
2. Connect a network cable to the XoT-S1, which makes a connection to the XMS possible.
3. As the QR code is displayed, scan it with a device that can connect to the XMS.

Evaluation firmware on XoT-S1

Some XoT-S1 devices may be delivered with evaluation firmware for proof-of-concept or initial rollout work. In XMS, evaluation firmware labels are marked in the Firmware Group selector and also appear as a warning in the dashboard notifications.

Evaluation firmware should be treated as temporary. After deployment or troubleshooting is complete, move the XoT to a firmware label that uses regular firmware.

On XoT-S1 devices running evaluation firmware, the USB-A port can also be used with a USB mass-storage device during boot. This can be used to:

• Provide initial network settings in locked-down environments.
• Load SSH debug settings for support or troubleshooting.
• Collect debug logs from the XoT.

Getting enrollment URL from Software XoT or Bridge

1. Login to the device and run the following command: grep URL /xotd/tmp/*-log.txt
2. Paste the URL into a web browser from which XMS is accessible.

Enrolling without XMS access

In some cases the person scanning the S1 QR code or getting the enrollment URL does not have access to the XMS. This can be especially true in cases where the XMS is not available over the internet.

In these cases it is possible to either send an image of the QR code itself or send the enrollment URL through some secure communication channel to an XMS administrator who can then perform the actual enrollment of the XoT.

Completing the Enrollment

Once you navigate to the enrollment URL and log in to the XMS, you are greeted with the Welcome to enrollment! screen.

Enter an XoT Name for the XoT you are enrolling and click Enroll.

When enrollment finishes, choose how to continue:

• Create a new device — Continue to the asset creation flow to add a protected asset (a device or subnet) behind this XoT.
• Go to XoT Details — Open the XoT's details page to configure it — network settings, protected assets, and XoT-Bridges — now or at any later time.

You can always return to the XoT in the XMS later to extend or change its configuration.

Pending Enrollments

Every XoT that contacts the XMS appears on the Pending Enrollments page, reachable from Pending enrollments in the main menu. Enrolling an XoT from this page is an alternative to opening its individual enrollment URL, and lets you enroll several XoTs in one go.

The page lists each waiting XoT with its Code, XoT ID, MAC Address, Status, and Last Updated time. The Status column shows where each XoT is in the process:

• Ready to enroll — The XoT can be enrolled directly from this page.
• Requires QR enrollment — The XoT must be enrolled from its enrollment URL; see Completing the Enrollment above.
• Enrolling via QR — Enrollment from an enrollment URL is in progress.
• Waiting for XoT — The XoT has been enrolled and is waiting to collect its certificate.
• Enrolling… — The enrollment is being processed.
• XoT ID already exists — An XoT with this ID is already enrolled; dismiss the entry.
• Error — The enrollment failed.

Select one or more XoTs and use:

• Enroll Selected — Opens the Batch Enroll Wizard. Available only when every selected XoT has the Ready to enroll status.
• Dismiss Selected — Removes the selected entries from the queue. Use this for duplicates, errors, or XoTs you do not intend to enroll.

These actions require an admin or superadmin role.

Batch Enroll Wizard

The Batch Enroll Wizard (Enroll Selected XoTs) enrolls all the selected XoTs in two steps:

1. Naming — Optionally assign a name to each XoT. Leave a name blank to use the XoT ID as the name. Click Next.
2. Location — Optionally assign a location, which is applied to all of the XoTs being enrolled. Click Enroll.

The wizard then reports how many XoTs were enrolled and lists any that failed.