Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Nickf_tw — Fri, 22 Mar 2024 18:06:25 GMT

Hi Amanda,

No worries about the delay, I have followed the link that you have sent me step by step using DPS. I deleted all of my old certificates and added the new ones to the code. I also am using the standard sample with no modifications and it finally worked!

Thank you so much for all of your help,

Nick

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Amanda Hsieh — Mon, 18 Mar 2024 21:00:12 GMT

Hi Nick,

Sorry for the delay. I was out of the office last week.

We just updated the Azure IoT docs to improve the onboarding/cert generation process. Please try the NCS v2.6.0 and have a look at that. We now provide CI commands + scripts to set up a device to Azure IoT hub. Instead of the previous manual process.

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/libraries/networking/azure_iot_hub.html

I would also recommend connecting with the "standard" unmodified sample in NCS first, before running your code if altered.

The new docs just changed from using the Azure UI to using the command line. The script is only used to generate and sign certificates.

[quote user="Nickf_tw"]I verified this CA and used it as my client-cert.pem and used the key as my private-key.pem.[/quote]

It sounds like you use your test CA certificate as the dev certificate:
That will not work. You need to sign the device certificate with the test CA, and you also mention modifying the PEM file tokens by hand. That’s definitely not recommended.

-Amanda H.

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Nickf_tw — Fri, 08 Mar 2024 18:24:37 GMT

Hey Amanda,

Sorry for the late response, I got the code to output more errors without using a pcap trace. I reformatted the DigiCert Global Root G2 certificate to this:

"-----BEGIN CERTIFICATE-----\n"
"MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBh\n"
"MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\n"
"d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH\n"
"MjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVT\n"
"MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j\n"
"b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkqhkiG\n"
"9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI\n"
"2/Ou8jqJkTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx\n"
"1x7e/dfgy5SDN67sH0NO3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQ\n"
"q2EGnI/yuum06ZIya7XzV+hdG82MHauVBJVJ8zUtluNJbd134/tJS7SsVQepj5Wz\n"
"tCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyMUNGPHgm+F6HmIcr9g+UQ\n"
"vIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQABo0IwQDAP\n"
"BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV\n"
"5uNu5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY\n"
"1Yl9PMWLSn/pvtsrF9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4\n"
"NeF22d+mQrvHRAiGfzZ0JFrabA0UWTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NG\n"
"Fdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBHQRFXGU7Aj64GxJUTFy8bJZ91\n"
"8rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/iyK5S9kJRaTe\n"
"pLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTfl\n"
"MrY=\n"
"-----END CERTIFICATE-----\n"

The main difference is the "-----BEGIN CA CERTIFICATE-----\n" and "-----END CA CERTIFICATE-----\n" changed to "-----BEGIN CERTIFICATE-----\n" and "-----END CERTIFICATE-----\n"

Upon doing this, the errors started to change to this:

*** Booting nRF Connect SDK v2.5.99-dev1 ***
OK
OK
OK
OK
OK
OK
OK
OK
OK
OK
OK
[00:00:00.014,923] <inf> spi_nor: mx25r6435f@0: 8 MiBy flash
[00:00:00.228,942] <inf> fs_nvs: 2 Sectors of 4096 bytes
[00:00:00.228,973] <inf> fs_nvs: alloc wra: 0, fe8
[00:00:00.228,973] <inf> fs_nvs: data wra: 0, 0
*** Booting nRF Connect SDK v2.5.99-dev1 ***
[00:00:00.229,400] <inf> azure_iot_hub_sample: Azure IoT Hub sample started
[00:00:00.229,431] <inf> azure_iot_hub_sample: Bringing network interface up and connecting to the network
[00:00:00.234,191] <dbg> mqtt_helper: mqtt_helper_poll_loop: Waiting for connection_poll_sem
[00:00:01.690,551] <inf> wifi_mgmt_ext: Connection requested

[00:00:01.691,833] <inf> azure_iot_hub_sample: Device ID: nRF7002DK
[00:00:01.691,864] <inf> azure_iot_hub_sample: Host name: ProjectEmilia1.azure-devices.net
[00:00:07.493,011] <inf> azure_iot_hub_sample: Network connectivity established and IP address assigned
[00:00:07.493,652] <inf> azure_iot_hub_sample: Connected to network
[00:00:07.494,445] <inf> azure_fota: Current firmware version: 0.0.0-dev
[00:00:07.494,445] <dbg> azure_iot_hub: azure_iot_hub_init: Azure FOTA initialized
[00:00:07.494,506] <dbg> azure_iot_hub: iot_hub_state_set: State transition: STATE_UNINIT --> STATE_DISCONNECTED
[00:00:07.494,506] <inf> azure_iot_hub_sample: Azure IoT Hub library initialized
[00:00:07.494,567] <dbg> azure_iot_hub: iot_hub_state_set: State transition: STATE_DISCONNECTED --> STATE_CONNECTING
[00:00:07.494,598] <inf> azure_iot_hub_sample: AZURE_IOT_HUB_EVT_CONNECTING
[00:00:07.494,628] <dbg> mqtt_helper: mqtt_state_set: State transition: MQTT_STATE_UNINIT --> MQTT_STATE_DISCONNECTED
[00:00:07.494,720] <dbg> azure_iot_hub: azure_iot_hub_connect: User name: ProjectEmilia1.azure-devices.net/nRF7002DK/?api-version=2020-09-30&DeviceClientType=azsdk-c%2F1.4.0-beta.2
[00:00:07.494,750] <dbg> azure_iot_hub: azure_iot_hub_connect: User name buffer size is 160, actual user name size is: 106
[00:00:07.494,812] <dbg> mqtt_helper: broker_init: Resolving IP address for ProjectEmilia1.azure-devices.net
[00:00:08.091,735] <dbg> mqtt_helper: broker_init: IPv4 Address found 40.71.14.133 (AF_INET)
[00:00:08.091,827] <dbg> mqtt_helper: mqtt_state_set: State transition: MQTT_STATE_DISCONNECTED --> MQTT_STATE_TRANSPORT_CONNECTING
[00:00:08.585,327] <dbg> mqtt_helper: mqtt_state_set: State transition: MQTT_STATE_TRANSPORT_CONNECTING --> MQTT_STATE_TRANSPORT_CONNECTED
[00:00:08.585,388] <dbg> mqtt_helper: mqtt_state_set: State transition: MQTT_STATE_TRANSPORT_CONNECTED --> MQTT_STATE_CONNECTING
[00:00:08.585,418] <dbg> mqtt_helper: client_connect: Using send socket timeout of 60 seconds
[00:00:08.585,418] <dbg> mqtt_helper: mqtt_helper_connect: MQTT connection request sent
[00:00:08.585,449] <inf> azure_iot_hub_sample: Connection request sent to IoT Hub
[00:00:08.586,181] <dbg> mqtt_helper: mqtt_helper_poll_loop: Took connection_poll_sem
[00:00:08.586,883] <dbg> mqtt_helper: mqtt_helper_poll_loop: Starting to poll on socket, fd: 9
[00:00:08.586,883] <dbg> mqtt_helper: mqtt_helper_poll_loop: Polling on socket fd: 9
[00:00:08.744,903] <dbg> mqtt_helper: mqtt_evt_handler: MQTT mqtt_client connected
[00:00:08.744,964] <dbg> mqtt_helper: mqtt_state_set: State transition: MQTT_STATE_CONNECTING --> MQTT_STATE_DISCONNECTED
[00:00:08.744,964] <err> azure_iot_hub: Connection was rejected with return code 5
[00:00:08.744,995] <wrn> azure_iot_hub: Is the device certificate valid?
[00:00:08.745,025] <dbg> azure_iot_hub: iot_hub_state_set: State transition: STATE_CONNECTING --> STATE_DISCONNECTED
[00:00:08.745,056] <inf> azure_iot_hub_sample: AZURE_IOT_HUB_EVT_CONNECTION_FAILED
[00:00:08.745,056] <inf> azure_iot_hub_sample: Error code received from IoT Hub: 5
[00:00:08.751,983] <dbg> mqtt_helper: mqtt_evt_handler: MQTT_EVT_DISCONNECT: result = -111
[00:00:08.752,044] <dbg> mqtt_helper: mqtt_state_set: Skipping transition to the same state (MQTT_STATE_DISCONNECTED)
[00:00:08.752,044] <wrn> azure_iot_hub: DISCONNECT, result: -111
[00:00:08.752,105] <dbg> azure_iot_hub: iot_hub_state_set: Skipping transition to the same state (STATE_DISCONNECTED)
[00:00:08.752,105] <inf> azure_iot_hub_sample: AZURE_IOT_HUB_EVT_DISCONNECTED
[00:00:08.752,136] <err> mqtt_helper: Cloud MQTT input error: -111
[00:00:08.752,166] <dbg> mqtt_helper: mqtt_helper_poll_loop: Waiting for connection_poll_sem

devzone.nordicsemi.com/.../6177.azure_5F00_iot_5F00_hub.zip

Immediately I started to check all my certificates and followed each step of the guide to creating them and would still receive the same error.

I saw a post that suggested removing the Baltimore Cyber Trust Root completely because Azure IoT Hub is now migrated. However, after running I still had the same error.

With my client certificate and private certificate, I have created a test CA and a corresponding key. I did not go into any more detail of creating subordinate CA's and Client certs because I do not care about the security of the device at the moment, I just want to get a simple message sent to my IoT Hub as the sample does.

I verified this CA and used it as my client-cert.pem and used the key as my private-key.pem.

I still received the same error and would appreciate more help!

I will also link my entire project to this in a .zip file so that you could see if I am missing anything.

Thank you so much,

Nick

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Amanda Hsieh — Thu, 29 Feb 2024 21:45:40 GMT

For pcap trace, you can use your computer as a hotspot and have the device connect to it over wifi. Then, trace with wirshark on that interface and isolate the TCP stream once captured.

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Nickf_tw — Sat, 24 Feb 2024 00:45:19 GMT

I added

CONFIG_MBEDTLS_LOG_LEVEL_DBG=y

to the nrf7002dk_nrf5340_cpuapp.conf. After building, the output terminal looks like it did not change anything from previous messages:

*** Booting nRF Connect SDK v2.5.0 ***
OK
OK
OK
OK
OK
OK
[00:00:00.014,801] <inf> spi_nor: mx25r6435f@0: 8 MiBy flash
[00:00:00.224,029] <inf> fs_nvs: 2 Sectors of 4096 bytes
[00:00:00.224,060] <inf> fs_nvs: alloc wra: 0, fe8
[00:00:00.224,060] <inf> fs_nvs: data wra: 0, 0
*** Booting nRF Connect SDK v2.5.0 ***
[00:00:00.224,456] <inf> azure_iot_hub_sample: Azure IoT Hub sample started
[00:00:00.224,487] <inf> azure_iot_hub_sample: Bringing network interface up and connecting to the network
[00:00:01.609,466] <inf> azure_iot_hub_sample: Device ID: DEVICEID
[00:00:01.609,497] <inf> azure_iot_hub_sample: Host name: HOSTNAME
[00:00:05.871,582] <inf> azure_iot_hub_sample: Network connectivity established and IP address assigned
[00:00:05.872,192] <inf> azure_iot_hub_sample: Connected to network
[00:00:05.872,955] <inf> azure_fota: Current firmware version: 0.0.0-dev
[00:00:05.872,955] <dbg> azure_iot_hub: azure_iot_hub_init: Azure FOTA initialized
[00:00:05.873,016] <dbg> azure_iot_hub: iot_hub_state_set: State transition: STATE_UNINIT --> STATE_DISCONNECTED
[00:00:05.873,016] <inf> azure_iot_hub_sample: Azure IoT Hub library initialized
[00:00:05.873,077] <dbg> azure_iot_hub: iot_hub_state_set: State transition: STATE_DISCONNECTED --> STATE_CONNECTING
[00:00:05.873,077] <inf> azure_iot_hub_sample: AZURE_IOT_HUB_EVT_CONNECTING
[00:00:05.873,138] <dbg> azure_iot_hub: azure_iot_hub_connect: User name: HOSTNAME/DEVICEID/?api-version=2020-09-30&DeviceClientType=azsdk-c%2F1.4.0-beta.2
[00:00:05.873,168] <dbg> azure_iot_hub: azure_iot_hub_connect: User name buffer size is 160, actual user name size is: 106
[00:00:06.531,738] <err> mqtt_helper: mqtt_connect, error: -22
[00:00:06.531,768] <err> azure_iot_hub: mqtt_helper_connect failed, error: -22
[00:00:06.531,799] <dbg> azure_iot_hub: iot_hub_state_set: State transition: STATE_CONNECTING --> STATE_DISCONNECTED
[00:00:06.531,829] <err> azure_iot_hub_sample: azure_iot_hub_connect failed: -22

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Amanda Hsieh — Fri, 23 Feb 2024 22:22:42 GMT

Try to enable CONFIG_MBEDTLS_LOG_LEVEL_DBG.

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Nickf_tw — Fri, 23 Feb 2024 21:50:17 GMT

Hey,

I have decided to not use DPS and to just use the Hostname and Device ID of my IoT Hub for simplicity of solving the issue.

1) This is how I formatted the Baltimore CyberTrust Root Certificate within the ca-cert-2.pem:

"-----BEGIN CA CERTIFICATE-----\n"
"MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ\n"
"RTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD\n"
"VQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX\n"
"DTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y\n"
"ZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy\n"
"VHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr\n"
"mD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr\n"
"IZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK\n"
"mpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu\n"
"XmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy\n"
"dc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye\n"
"jl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1\n"
"BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3\n"
"DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92\n"
"9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/szKN+OMY3EU/t3Wgx\n"
"jkzSswF07r51XgdIGn9w/xZchMB5hbgF/X++ZRGjD8ACtPhSNzkE1akxehi/oCr0\n"
"Epn3o0WC4zxe9Z2etciefC7IpJ5OCBRLbf1wbWsaY71k5h+3zvDyny67G7fyUIhz\n"
"ksLi4xaNmjICq44Y3ekQEe5+NauQrz4wlHrQMz2nZQ/1/I6eYs9HRCwBXbsdtTLS\n"
"R9I4LtD+gdwyah617jzV/OeBHRnDJELqYzmp\n"
"-----END CA CERTIFICATE-----\n"

This is how I formatted the DigiCert Global Root G2 Certificate within the ca-cert.pem:

"-----BEGIN CA CERTIFICATE-----\n"
"MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBh\n"
"MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\n"
"d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH\n"
"MjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVT\n"
"MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j\n"
"b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkqhkiG\n"
"9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI\n"
"2/Ou8jqJkTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx\n"
"1x7e/dfgy5SDN67sH0NO3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQ\n"
"q2EGnI/yuum06ZIya7XzV+hdG82MHauVBJVJ8zUtluNJbd134/tJS7SsVQepj5Wz\n"
"tCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyMUNGPHgm+F6HmIcr9g+UQ\n"
"vIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQABo0IwQDAP\n"
"BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV\n"
"5uNu5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY\n"
"1Yl9PMWLSn/pvtsrF9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4\n"
"NeF22d+mQrvHRAiGfzZ0JFrabA0UWTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NG\n"
"Fdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBHQRFXGU7Aj64GxJUTFy8bJZ91\n"
"8rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/iyK5S9kJRaTe\n"
"pLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTfl\n"
"MrY=\n"
"-----END CA CERTIFICATE-----\n"

I applied the same format to the client certificate and private key in the sample code.

2) I followed the exact steps for generating a Root CA, Subordinate CA, Client Certificate, and Device private key. I uploaded the subordinate CA to the Azure IoT Hub and got it verified.

3) I apologize for the simple questions in advance because I am still very new, how would I implement a pcap trace and mbedtls logs to the code in order to see more details in my logging?

I appreciate all the help you are giving me!

-Nick

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Amanda Hsieh — Fri, 23 Feb 2024 14:55:04 GMT

Hi,

Please check the format of the certs. The Azure IoT Hub library requires the provisioning of the following certificates and a private key for a successful TLS connection:

Baltimore CyberTrust Root Certificate - Server certificate, used to verify the server’s certificate while connecting.
Public device certificate - generated by the procedures described in Creating Azure IoT Hub certificates , used by Azure IoT Hub to authenticate the device.
The private key of the device.

It would be nice with a pcap trace and mbedtls logs.

-Amanda H.

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Nickf_tw — Wed, 21 Feb 2024 22:01:06 GMT

I already have the Kconfig file configured like this:

# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause

CONFIG_AZURE_IOT_HUB_DPS=y

# The ID scope can be omitted and provided at run time

CONFIG_AZURE_IOT_HUB_DPS_ID_SCOPE="MY_ID_SCOPE"

And I added the fragment file while building.

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Amanda Hsieh — Wed, 21 Feb 2024 16:52:17 GMT

For DPS, you will need to configure the Kconfig options seen in the Kconfig fragment file overlay-dps.conf in the sample folder.

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Nickf_tw — Tue, 20 Feb 2024 22:05:45 GMT

Hey,

I added the configs and added the certificates with the correct names. For ca-cert.pem I added the Digi Cert G2 and for ca-cert-2.pem I added the Baltimore Root from the Azure IoT Hub Doc link you provided.

For the client and private key certificates I used ssl to generate self signed certificates.

I copied the contents of the certificates to the .pem files in the sample code and added them to my Azure DPS individual enrollment.

After building and flashing I still get this error:

*** Booting nRF Connect SDK v2.5.0 ***
OK
OK
OK
OK
OK
OK
[00:00:00.012,939] <inf> spi_nor: mx25r6435f@0: 8 MiBy flash
[00:00:00.220,092] <inf> fs_nvs: 2 Sectors of 4096 bytes
[00:00:00.220,092] <inf> fs_nvs: alloc wra: 0, fe8
[00:00:00.220,123] <inf> fs_nvs: data wra: 0, 0
*** Booting nRF Connect SDK v2.5.0 ***
[00:00:00.220,489] <inf> azure_iot_hub_sample: Azure IoT Hub sample started
[00:00:00.220,489] <inf> azure_iot_hub_sample: Bringing network interface up and connecting to the network
[00:00:01.507,781] <inf> azure_iot_hub_sample: Device ID: REGID
[00:00:06.352,752] <inf> azure_iot_hub_sample: Network connectivity established and IP address assigned
[00:00:06.353,302] <inf> azure_iot_hub_sample: Connected to network
[00:00:06.353,332] <inf> azure_iot_hub_sample: Starting DPS
[00:00:06.353,363] <dbg> azure_iot_hub_dps: dps_reg_id_set: Setting DPS registration ID: REGID
[00:00:06.353,393] <dbg> azure_iot_hub_dps: dps_id_scope_set: No ID scope provided, using ID scope from Kconfig: IDSCOPE
[00:00:06.353,424] <dbg> azure_iot_hub_dps: dps_id_scope_set: Setting DPS ID scope: IDSCOPE
[00:00:06.353,454] <dbg> azure_iot_hub_dps: dps_on_settings_loaded: Settings fully loaded
[00:00:06.353,515] <dbg> azure_iot_hub_dps: dps_state_set: State transition: DPS_STATE_UNINIT --> DPS_STATE_DISCONNECTED
[00:00:06.353,515] <inf> azure_iot_hub_sample: DPS registration status: AZURE_IOT_HUB_DPS_REG_STATUS_NOT_STARTED
[00:00:06.353,576] <dbg> azure_iot_hub_dps: provisioning_client_init: Client ID (size: 11): REGID
[00:00:06.353,637] <dbg> azure_iot_hub_dps: provisioning_client_init: User name (size: 60): IDSCOPE/registrations/REGID/api-version=2019-03-31
[00:00:07.327,545] <err> mqtt_helper: mqtt_connect, error: -22
[00:00:07.327,575] <err> azure_iot_hub_dps: mqtt_helper_connect failed, error: -22
[00:00:07.327,575] <err> azure_iot_hub_sample: DPS failed to start, error: -22
[00:00:07.327,606] <err> azure_iot_hub_sample: Failed to run DPS, error: -22, terminating connection attempt

Thank you,

- Nick

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Amanda Hsieh — Tue, 20 Feb 2024 15:59:35 GMT

Hi,

The MQTT helper library can provision the credentials for nRF7002 DK. The following files need to be added and populated

It is important that both ca-cert.pem and ca-cert-2.pem are used, because Azure uses two different root certificates in a transition period. Please refer to https://techcommunity.microsoft.com/t5/internet-of-things-blog/azure-iot-tls-critical-changes-are-almost-here-and-why-you/ba-p/2393169

In addition to the credential files, these configs may be needed if they're not already set:

CONFIG_MQTT_HELPER_PROVISION_CERTIFICATES=y
CONFIG_MQTT_HELPER_SECONDARY_SEC_TAG=11
CONFIG_MQTT_HELPER_PORT=8883

That should be it.

-Amanda H.

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Nickf_tw — Sat, 17 Feb 2024 00:12:38 GMT

Hi Amanda,

Thank you for replying! I looked into the doc before and this was the only thing I could find for provisioning certificates to the board:

The issue is that I cannot do this with the nRF7002DK.

RE: Help Needed: Integrating Certificates with azure_iot_hub Sample on nRF7002DK for Azure Connection

Amanda Hsieh — Fri, 16 Feb 2024 22:31:39 GMT

Hi,

Please check Azure IoT Hub docs.

Regards,
Amanda H.