Matter PAI
Your own branded intermediate CA — under SSL.com's Matter-accredited root
A Matter Product Attestation Intermediate (PAI) gives device manufacturers their own intermediate Certificate Authority under SSL.com's CSA-authorized PAA root. Every DAC issued from your PAI carries your organization's identity in the certificate chain.
Your own intermediate CA for Matter device certificates
The Matter security model uses a three-level certificate chain: PAA (root CA, operated by CSA-authorized entities like SSL.com) → PAI (intermediate CA, per manufacturer) → DAC (unique per-device leaf certificate).
When SSL.com issues you a PAI, your organization becomes the intermediate CA for your product line. Your company name appears in every device's certificate chain.
DAC only (no PAI)
SSL.com PAA → SSL.com PAI → Device DAC
Your own PAI
SSL.com PAA → Your PAI → Device DAC
A PAI is the right choice when…
Scale matters
You manufacture at sufficient scale that your own intermediate CA is strategically important.
Brand identity
Your brand in the certificate chain matters — for enterprise customers or regulatory contexts.
Multiple product lines
You have multiple product lines that should be separated in the PKI hierarchy.
Direct control
You want to control DAC issuance directly via your own systems using the REST API.
Key benefits
Request Matter PAI issuance
PAI issuance is an enterprise engagement. Contact our IoT certificate team to discuss your device volumes, product-line structure, key custody requirements, and manufacturing-line integration approach.
How it works
Organization validation
SSL.com validates your organization and confirms eligibility.
PAI issuance
SSL.com issues your PAI signed by SSL.com's CSA-authorized PAA root.
Key custody
PAI private key stored in a cloud HSM managed by SSL.com.
DAC issuance
Use the REST API to issue DACs from your PAI for each device.
Matter certification
Devices carrying DACs from your PAI are valid for Matter certification.
Frequently asked questions
Related products
Matter DAC
Individual device certificates — simpler and faster for most manufacturers.
Client Authentication
Machine-to-machine network access control for IoT devices.
OV Code Signing
Sign device firmware and OTA update packages.
