API registration of certification for Azure IoT Hub / DPS

RE: API registration of certification for Azure IoT Hub / DPS

Thomas — Thu, 21 Dec 2023 12:18:31 GMT

OK, I will try to replicate this using the http_sample. Yesterday I looked at the http_update sample and tried to move my certificate update code into main and just call the nrf_modem_lib_init() before like in the sample. This did not solve the problem.

It must be some project configuration is my best quess.

Would it be possible that you test the same with the azure iot_hub sample. It should now be possible to test for the problem just by reading out the keys witht the AT%CMNG= command.

RE: API registration of certification for Azure IoT Hub / DPS

Charlie — Thu, 21 Dec 2023 09:51:36 GMT

I tested with the official sample NCS\v2.5.0\nrf\samples\cellular\http_update sample to write devzone.nordicsemi.com/.../7633.DigiCertGlobalRootG2.zip from DigiCertGlobalRootG2.crt.pem to secure tag 42. You can see they have the same hash compared with the one I wrote with Certificate Manager on secure tag 11 on the previous test. Can you refer to

cert_provision(void) function to see the difference with your certificate writing function.

> AT+CFUN=4

OK
> AT%CMNG=

...
%CMNG: 11,0,"0E0A61E2E78D28EEA66B15A9B10C1F4E5E8AD379FEA9131D02EC4A2473F9AB9C"
...
%CMNG: 42,0,"0E0A61E2E78D28EEA66B15A9B10C1F4E5E8AD379FEA9131D02EC4A2473F9AB9C"
...

Best regards,

Charlie

RE: API registration of certification for Azure IoT Hub / DPS

Thomas — Wed, 20 Dec 2023 14:36:32 GMT

When programming through the API i get the following output from AT%CMNG=1

%CMNG: 10,0,"5D550643B6400D4341550A9B14AEDD0B4FAC33AE5DEB7D8247B6B4F799C13306"
%CMNG: 10,1,"D4862B18AC6273370888FB97E9226BBC0C52DA7E31E36204C9AD628154150A61"
%CMNG: 10,2,"D35A573739C923DA63AB595741891BD7D511A0EE4D94070DC2E3A9600E61DCD8"

When using Cellular monitor to program the same certificates I get this:

%CMNG: 10,0,"0E0A61E2E78D28EEA66B15A9B10C1F4E5E8AD379FEA9131D02EC4A2473F9AB9C"
%CMNG: 10,1,"5E66996270A307E66456B3308AC57846491512A7C6BE9ABA56A0BE2067BB386B"
%CMNG: 10,2,"D93C4F4E4092F5F2BB85240D2E015C5138A142047CE798FBEFC45D5EC2C4272A"

Seems the programming is going wrong i some way....

Cannot see that I'm using the API in a wrong way. This is how I program the device certificate:

static const char devicecert[] =

"-----BEGIN CLIENT CERTIFICATE-----\n"

"MIIDkjCCAnqgAwIBAgIQUV/Nblig8uTS5jYZbZQqxDANBgkqhkiG9w0BAQsFADAl\n"

"MSMwIQYDVQQDDBpQcm9sb24gSW9UIEh1YiBTdWJvcmRpbmF0ZTAeFw0yMzEyMTgx\n"

"MzI5MzhaFw0yNDEyMTcxMzI5MzhaMG4xCzAJBgNVBAYTAkRLMRMwEQYDVQQIDApD\n"

"b3BlbmhhZ2VuMSMwIQYDVQQKDBpQcm9sb24gQ29udHJvbCBTeXN0ZW1zIEFwUzEP\n"

"MA0GA1UECwwGYm1zbmV0MRQwEgYDVQQDDAt0ZXN0ZGV2aWNlMjCCASIwDQYJKoZI\n"

"hvcNAQEBBQADggEPADCCAQoCggEBAKwuYEyMQkCC7e5RLuhyXUp2imLojrALGdM2\n"

"yx68nkDl3adAi9cueoxnKWSlyvPKjUuHIjVBK+TE7/lqY0C/n2Ek2qqcPef2eq91\n"

"BQTtGKb9FNsTRnO/uyIki2jVVDMK95ckJFJyceDkDbhNnGktchvBBrjygKSRdb0P\n"

"dlxvAsjPPXvodSo+indzB9yn6PXPlN7amjtnt1pD+DKyQbfQCrxTEUW5G7eVuOYL\n"

"SVGBORbmo1dztb4sVgWED2FBAFdgxcQKy9oKewn+jLJfjGnRVpgGftFCp1cjDDeE\n"

"ozxCJxN63JGdmKLDLT2BPZfulwNnRXEqZxhn5m5cDgg4BSTOnsUCAwEAAaN1MHMw\n"

"HwYDVR0jBBgwFoAUyZSi36zVoNyHwg0fL45JyfK3wdkwDAYDVR0TAQH/BAIwADAT\n"

"BgNVHSUEDDAKBggrBgEFBQcDAjAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFCMd\n"

"dDd/pqu+Y8B/ungcWTssi3JbMA0GCSqGSIb3DQEBCwUAA4IBAQDAcfeWeOIwO+et\n"

"JSiindHTMfSWAijZ3Ncc5FCR5npl3p41ctL7vsiyAqxdEN6pEsR9YAyfyPykBZjg\n"

"NITjwAuUhUv211R9WulzjVJPEJDOFbK1T6Z2Cr51hv/xJ2qZYETfBlWliCaHhXfJ\n"

"H2Novo+LkWpNEz7yDk1/yPF5PuhFJhQlYyyFf4oys610HL5ZM8YpmGGE+fpFOjIH\n"

"VtGq8yBTQwogqR9Ww7FwaGrVF1LQSb4ejyNhCaoQs5fmB/myBcPudwsuNdqqPZ5S\n"

"mJx+qeIS3+eQaEtoelnWZKxXkgDhPbsRYzoKB4x8WZH3bx7gK4LB6kJyQe9v+IFV\n"

"FBlZXfHT\n"

"-----END CLIENT CERTIFICATE-----\n";

modem_key_mgmt_write(CONFIG_MQTT_HELPER_SEC_TAG, MODEM_KEY_MGMT_CRED_TYPE_PUBLIC_CERT, devicecert, sizeof(devicecert)-1))

I know the modem cannot be online so I am programming in the following hook:

static void on_modem_lib_init(int ret, void *ctx)

{

LOG_INF("Modem initialized");

UpdateCertificates();

}

NRF_MODEM_LIB_ON_INIT(lwm2m_init_hook, on_modem_lib_init, NULL);

What can be wrong?

RE: API registration of certification for Azure IoT Hub / DPS

Thomas — Wed, 20 Dec 2023 14:21:05 GMT

Right. It seems that saving the certificates using modem_key_mgmt_exists causes the problem.

I am back on my test hub using only DigiCert certificate. Programming only 3 certificates, the CA, public and private.

If the 3 certificates are programmed using Cellular Monitor it works.

If the same 3 certificates are programmed using the API, it does not work...

Could it be the format (newlines...):

const char * const devicecert =