OperationalCredentials Cluster

Cluster ID: 0x003E  |  Endpoint: Fixed on Endpoint 0 (Root Endpoint)

OperationalCredentials is the cornerstone of Matter device secure communication — responsible for managing device Node Operational Certificates (NOC) and Fabric credentials. Every Matter device that joins a Fabric (home network) needs to complete certificate issuance and installation through this Cluster. It is also the core of multi-admin scenarios — a single device can join multiple Fabrics simultaneously, with each Fabric independently managing its own NOC.

Commands

The OperationalCredentials Cluster has 8 commands covering the complete flow of device attestation, CSR generation, NOC installation, and Fabric management. Most commands are automatically called by the Commissioner during commissioning; App developers typically do not need to send them manually. However, understanding these commands is crucial for debugging commissioning failures and implementing multi-admin. Click a command ID in the table below to jump to its detailed description.

AttestationRequest — Device Attestation Request(0x00)

The first step of commissioning: verify whether the device is a legitimate Matter device. The Commissioner sends a random number (Nonce), and the device signs the Nonce and device information with the DAC (Device Attestation Certificate) private key to prove it holds a legitimate DAC.

↑ Back to Commands

AttestationResponse — Device Attestation Response(0x01)

Automatic reply after the device receives AttestationRequest. Contains device attestation information and DAC signature. The Commissioner verifies the signature upon receipt, checks the DAC certificate chain (DAC → PAI → PAA), and confirms device legitimacy.

↑ Back to Commands

CertificateChainRequest — Certificate Chain Request(0x02)

Request the device to return the DAC (Device Attestation Certificate) or PAI (Product Attestation Intermediate Certificate). The Commissioner needs the complete certificate chain to verify the device attestation signature — DAC is issued by PAI, PAI is issued by PAA.

↑ Back to Commands

CertificateChainResponse — Certificate Chain Response(0x03)

The device returns the requested certificate. Certificate format is DER-encoded X.509 v3.

↑ Back to Commands

CSRRequest — CSR Generation Request(0x04)

Instructs the device to generate a new Operational Key Pair and return a CSR (Certificate Signing Request) containing the public key. After receiving the CSR, the Commissioner uses its own Root CA to issue the NOC certificate, then writes it to the device via AddNOC.

↑ Back to Commands

CSRResponse — CSR Response(0x05)

The device returns CSR data and DAC signature. The Commissioner verifies the signature and extracts the CSR for issuing the NOC.

↑ Back to Commands

AddNOC — Install NOC(0x06)

A critical step in the commissioning flow: write the Commissioner-issued NOC certificate to the device, officially adding the device to a new Fabric. This is the command with the most parameters in the entire certificate installation flow. Upon successful execution, the device receives a new FabricIndex.

↑ Back to Commands

UpdateNOC — Update NOC(0x07)

Updates the current Fabric's NOC certificate. Typically used when the certificate is about to expire or key rotation is needed. Can only update the NOC of the Fabric that issued this command; cross-Fabric operations are not allowed.

↑ Back to Commands

UpdateFabricLabel — Update Fabric Label(0x09)

Modify the current Fabric's user-defined label (e.g., "Home", "Office"). Purely for display purposes, does not affect security or communication. Can only modify the label of the Fabric that issued the command.

↑ Back to Commands

RemoveFabric — Remove Fabric(0x0A)

Removes the specified Fabric from the device. Deletes the Fabric's corresponding NOC, ICAC, trusted root certificate, ACL entries, and all associated data. Can remove any Fabric (including other administrators'), making this a high-privilege operation.

↑ Back to Commands

AddTrustedRootCertificate — Add Trusted Root Certificate(0x0B)

Writes a Root CA certificate to the device. This is a prerequisite step for AddNOC — the device needs to know which Root CA to trust before it can accept NOCs issued by that CA. Each Fabric corresponds to one trust root.

↑ Back to Commands

Attributes

The OperationalCredentials Cluster has 6 attributes, divided into Fabric information and capacity management groups. Click an attribute ID in the summary table below to jump to its detailed description.

Fabric Info (0x0000, 0x0001, 0x0004)

Describes the certificates, identities, and trust root information for each Fabric the device has joined.

↑ Back to Attributes

Capacity Management (0x0002, 0x0003, 0x0005)

Describes the device's Fabric capacity and current operation context.

↑ Back to Attributes

Enum Definitions

NodeOperationalCertStatusEnum

Unified return status code for AddNOC, UpdateNOC, UpdateFabricLabel, and RemoveFabric commands (StatusCode field in NOCResponse).

CertificateChainTypeEnum

Specifies the certificate type to retrieve in the CertificateChainRequest command.

Data Structures

NOCStruct

Each element in the NOCs attribute list, containing a Fabric's NOC and optional ICAC certificate.

FabricDescriptorStruct

Each element in the Fabrics attribute list, describing a Fabric's public information.

Example Data

The following is the OperationalCredentials attribute read result of a Matter device that has joined one Fabric (excluding NOCs, as Fabric-scoped restriction only allows reading your own):

{
  // --- Fabric Info ---
  "0x0001": [{                    // Fabrics — Joined Fabric list
    "rootPublicKey": "BNkX2...",  // Root CA public key (Base64)
    "vendorID": 65521,            // VendorID = 0xFFF1 (test vendor)
    "fabricID": 1,                // FabricID = 1
    "nodeID": 1234,               // This device's NodeID in this Fabric
    "label": "Home",              // User-defined label
    "fabricIndex": 1              // Fabric index
  }],

  // --- Capacity & Count ---
  "0x0002": 5,                    // SupportedFabrics = 5 (max 5 Fabrics)
  "0x0003": 1,                    // CommissionedFabrics = 1 (currently joined 1)

  // --- Trusted Root Certificates ---
  "0x0004": [                     // TrustedRootCertificates — Trusted Root CA list
    "MIIBnT..."                   // One Root CA certificate per Fabric (Base64 DER)
  ],

  // --- Current Context ---
  "0x0005": 1                     // CurrentFabricIndex = 1 (current operation's Fabric)
}

CSR Flow Interaction Example

Interaction during commissioning where the Commissioner requests the device to generate a CSR:

// 1. Commissioner → Device: Request CSR generation
{
  "invokeRequests": [{
    "commandPath": {
      "endpointId": 0,
      "clusterId": "0x003E",
      "commandId": "0x04"          // CSRRequest
    },
    "commandFields": {
      "CSRNonce": "dGhpcyBpcyBhIDMyLWJ5dGUgbm9uY2U="  // 32-byte random number (Base64)
    }
  }]
}

// Device → Commissioner: Return CSR
{
  "NOCSRElements": "MIHd...",      // NOCSR structure (containing CSR + CSRNonce)
  "attestationSignature": "MEU..." // Device signs with DAC private key
}

AddNOC Interaction Example

Commissioner writes the issued NOC to the device:

// 2. Commissioner → Device: Write the signed NOC
{
  "invokeRequests": [{
    "commandPath": {
      "endpointId": 0,
      "clusterId": "0x003E",
      "commandId": "0x06"          // AddNOC
    },
    "commandFields": {
      "NOCValue": "MIIB...",       // Issued NOC certificate (DER Base64)
      "ICACValue": "MIIB...",      // Optional intermediate CA certificate
      "IPKValue": "wMs7...",       // 16-byte Identity Protection Key
      "caseAdminSubject": 112233,  // CASE administrator's Subject (NodeID)
      "adminVendorId": 65521       // Administrator's VendorID
    }
  }]
}

// Device → Commissioner: Return result
{
  "statusCode": 0,                 // OK
  "fabricIndex": 1                 // Newly assigned FabricIndex
}

Common Scenarios