API registration of certification for Azure IoT Hub / DPS

[Thomas]

I am trying to connect a custom device to the Azure IoT Hub using DPS service. Because I am using a custom board I am trying to write certificates to the modem using api calls to the modem_key_mgmg functions. Theses functions have a tag and a credential type.

But trying to get around the different certificates in use.and what tags and credential types i should use when writing the certificates.

I have registered Baltimore and DigiCert root CA certificates using the tag CONFIG_MQTT_HELPER_SEC_TAG and CONFIG_MQTT_HELPER_SECONDARY_SEC_TAG and both of them with credential type set to MODEM_KEY_MGMT_CRED_TYPE_PUBLIC_CERT.

For the device certificate I am not really sure what the tag should be, so just set it to 12 for both types.

Then the private certificate is registered with type MODEM_KEY_MGMT_CRED_TYPE_PRIVATE_CERT.

But what about the public part? Should it be MODEM_KEY_MGMT_CRED_TYPE_PUBLIC_CERT?

Is the above at all correct? I am wondering about the tag field since I find no description except a reserrved tag for nRFCloud. Is it used somewhere in the Nordic libraries for Azure and has to have a specific value?

I am getting mqtt_helper, mqtt_connect, error: -111 when trying to connect.

[Charlie]

Hi Thomas,

Thanks for checking with us. The error is also reported in the following case. Have you read through it before to find some hint?

(+) Sample Azure IoT Hub (Thingy9.1) - Nordic Q&A - Nordic DevZone - Nordic DevZone (nordicsemi.com)

Best regards,

Charlie

[Thomas]

Hi Charlie

I have not tested different things to see if I can find a solution....

I have gone through the the Microsoft tutorial on creating and uploading certificates from the beginning again. This was to test that I did not have a problem with the certificates. I have created new internal root CA, subordinate and device certificates.

From this I have

• Internal root CA
• Subordinate certificate used for creating device certificates
• Device certificate(s)
• Device private key(s)

I also have two other public certificates old and new IoT hub

• Baltimore
• DigiCert

There are a number of different ways I can register these certificates in the device.... Is it possible that someone can describe this process from within the application.

I think the only certificates needed in the device is

• Device certificate(s)
• Device private key(s)
• Baltimore
• DigiCert

So I'm doing:

modem_key_mgmt_write(CONFIG_MQTT_HELPER_SEC_TAG, MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN, digicert, sizeof(digicert));

modem_key_mgmt_write(CONFIG_MQTT_HELPER_SECONDARY_SEC_TAG,MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN, baltimore, sizeof(baltimore));

modem_key_mgmt_write(CONFIG_MQTT_HELPER_SEC_TAG, MODEM_KEY_MGMT_CRED_TYPE_PUBLIC_CERT, devicecert, sizeof(devicecert));

modem_key_mgmt_write(CONFIG_MQTT_HELPER_SEC_TAG, MODEM_KEY_MGMT_CRED_TYPE_PRIVATE_CERT, devicecertpriv, sizeof(devicecertpriv))

[Thomas]

If just using IoT hub, how do you add the device, especially authentification!

[Charlie]

Thomas said:

When uploading a certificate to Azure IoT hub certificates list, are you using the PEM file with only the generated subordinate certificate or a manually combined file with the certificate section for both subordinate and slef-signed root CA?

I uploaded the PEM file with only the generated subordinate certificate.

Thomas said:

When adding your testdevice do you set authentificate to "X.509 Self-Signed" or "X.509 CA Signed"?

It uses X.509 Self-Signed. I input the secondary thump print same as the first.

Best regards,

Charlie

[Thomas]

I got it connected using Cellular Monitor and fixed on mistake by me. My thumprint was from the subordinate certificate. When creating a device directly like this, it is the thumprint of the device certificate.

These are the 3 certificates used when writing from Cellular Monitor.

MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN

MODEM_KEY_MGMT_CRED_TYPE_PRIVATE_CERT

MODEM_KEY_MGMT_CRED_TYPE_PUBLIC_CERT

Moving to test on my own hub if this succeeds I will test with DPS.

I have verified that I can connect to my own hub if I replace the Digicert root CA with the Baltimore one.

 

[Thomas]

Another huge problem. I need two root CA in the device.

I need both Baltimore and Digicert to exist in my device......

My hub is currently running with Baltimore so to connect now I need Baltimore and at an unknown time it will change to Digicert. If I do not have both certificates in the device I will loose connection.

The current 3 certificates are downloaded with key 10.

Should I just add 3 certificates with key 11 also replacing the CA for Baltimore with Digicert

[Charlie]

Thomas said:

I wanted to validate what types are used in the 3 windows of Cellular Monitor...

Certificate Manager windows correspond to the following tree types. NCS\v2.5.0\nrf\samples\cellular\http_update samples demonstrate how to properly write certificates in fw.

MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN

MODEM_KEY_MGMT_CRED_TYPE_PUBLIC_CERT

MODEM_KEY_MGMT_CRED_TYPE_PRIVATE_CERT

This is not suggested since it will occupy many memory sizes and is also not secure.

Thomas said:

My hub is currently running with Baltimore so to connect now I need Baltimore and at an unknown time it will change to Digicert. If I do not have both certificates in the device I will loose connection.

Couldn't the two sets of keys stored in different secure tags solve your problem?

My first test showed when Baltimore in CONFIG_MQTT_HELPER_SEC_TAG did not work, it would automatically switch to Digicert in CONFIG_MQTT_HELPER_SECONDARY_SEC_TAG to build the connection.

Best regards,

Charlie