Certificate Management

Matter fabrics use Node Operational Certificates (NoCs) for devices and user NoCs so people can administer the fabric. The SDK talks to RainMaker cloud APIs; CSRs are created through the Commission Adaptor secure storage.

What this module does

Certificates are part of the normal Matter lifecycle in this SDK:

• Node NoC is issued during commissioning when the device submits a CSR.
• User NoC is issued when you need to grant the current user admin access to a fabric (for example, after creating a fabric or when signing in on a new phone).

Fabric CA and root material are returned from getFabricDetails—you normally do not manage those manually.

---

Issue node certificate

Typically invoked by startCommissioning (or an equivalent commissioning orchestration flow)—not directly from UI code.

const commissioningRequest = await fabric.issueNodeNoC({
  csr: "<BASE64_ENCODED_CSR>",
  deviceId: "<DEVICE_ID>",
});

Follow with confirmMatterNodeCommissioning on the returned ESPRMMatterCommissioningRequest.

---

Issue user certificate

Grants the current user a fabric user certificate. CSR generation uses matterCommissioningAdaptor.generateCSR:

try {
  const userCertResponse = await fabric.issueUserNoC();
  const userCert = userCertResponse.certificates?.[0];

  if (userCert) {
    const { userNoC, matterUserId, groupId } = userCert;
    // Store or pass to native layer as required
  }
} catch (error) {
  console.error("Certificate issuance failed:", error);
}

Call after creating or converting a fabric if the user must control Matter devices from this installation.

---

Challenge-response (RainMaker Matter)

RainMaker Matter devices prove ownership during confirm using a cryptographic challenge. Native code signs the challenge; you pass challengeResponse (and related metadata) into confirmMatterNodeCommissioning.

---

Advanced: challenge-response plumbing

Challenge-response is typically implemented in your native commissioning layer. Ensure your adapter normalizes the confirmation event so your app can provide:

• rainmakerNodeId (for RainMaker Matter nodes)
• challengeResponse (signed challenge)
• matterNodeId (Matter identifier)

---

Error handling

Error type	When
ESPRMMatterValidationError	Invalid CSR, missing adapter, bad confirm payload
ESPRMMatterFabricError	Fabric not ready or permission issues

Human-readable messages are mapped in the SDK error message tables.