Google CAST

Chromecast built-in is a security commitment,
not just a certificate.

OnBoard™ IoT Security (OBIS) is built to that bar — key storage, CA operation, factory provisioning, end to end. Host both CA layers on OBIS, or keep your OEM CA on your existing PKI.

Security Bar

Built for the Cast security bar.

The Google Cast program carries security requirements across three operational areas. OBIS operates to those requirements end-to-end.

Key Management

Keys never leave the hardware boundary.

OBIS performs every key operation in HSM —with no extraction path, for OEMs or for Snowball operators.

CA Operation

Every signing is authorized and recorded.

OBIS records every signing event with operator, timestamp, and approval chain —exportable as a complete operational record.

Factory Provisioning

Injection runs under authorization, not on trust.

EdgeHSM enforces all three: offline-capable, per-line authorization, encrypted payloads only on the programming station.

TRUST CHAIN

A four-tier certificate hierarchy.

Google operates the Cast root, and each device carries a unique device certificate at the bottom. Between them sit two intermediate layers — OEM CA and Model CA. The Model CA and device certificate issuance always run on OBIS; the OEM CA is the variable.

MULTI-CREDENTIAL PROVISIONING

Cast certificate, plus everything else the device needs.

Devices with Chromecast built-in typically require multiple credentials — Cast, OEM cloud identity, Matter DAC, and OTA/local encryption keys — each provisioned through separate services and workflows. OBIS consolidates them into a single Production Version, provisioned in one production-line step.

BEYOND DAY ONE

The certificate is day one. The platform stays for the rest.

Cast certificates expire and firmware requires ongoing updates, while CRA mandates security support throughout a device’s typical 5–10 year lifecycle. OBIS centralizes certificates, keys, SBOMs, and audit trails in one platform across the full device lifespan.

Lifecycle

Get Started

Ship Chromecast built-in. Skip the audit project.

A 30-minute walkthrough covers your hosting model, your factory setup, and how OBIS maps to the program's security requirements — with your security architect,
not a sales deck.

Chromecast built-in is a security commitment, not just a certificate.

Built for the Cast security bar.

Keys never leave the hardware boundary.

Every signing is authorized and recorded.

Injection runs under authorization, not on trust.

A four-tier certificate hierarchy.

Cast certificate, plus everything else the device needs.

The certificate is day one. The platform stays for the rest.

factory provisioning

Secure Update

Compliance & Disclosure

Matter

Ship Chromecast built-in. Skip the audit project.

Cookie Preferences

Chromecast built-in is a security commitment,
not just a certificate.