A secure infrastructure onboarding system includes an infrastructure device with an infrastructure device wireless subsystem that it may use to perform wireless key management system discovery operations in response to initialization. A key management system includes a key management system wireless subsystem it uses to perform the wireless key management system discovery operations with the infrastructure device. The key management subsystem may then wirelessly receive an infrastructure device certificate along with an infrastructure device validation key from the infrastructure device, and validate the first infrastructure device based on the first infrastructure device certificate and the first infrastructure device validation key. In response, the key management system may wirelessly transmit a first credential generation key that is configured for use by the first infrastructure device to generate first authentication credentials.