This slide illustrates the chain of trust established with the AWS IoT account. First the OEM creates an AWS IoT account and sets up OEM Certification Authority, the CA, which can be an existing OEM capability, a 3rd party Trusted CA, or even use a Microchip CA kit. Next, the OEM creates the certificates for Microchip production signers and the OEM continues by registering the production signer certificates into their AWS account. The Device Certificates are loaded in the ECC508A in Microchip factories and signed to finally generate the private key. Then the device certificates are automatically transferred to the AWS IoT account and registered on first TLS connection with AWS IoT Just in Time Registration. Every customer has their own Customized Part Number (CPN) with their secret safely stored.