Difficulty Provisioning Thingy91 to AWS IoT Fleet Provisioning (Claim Method)

Dear Team,

I am attempting to provision my Thingy91 device to AWS IoT Core using Fleet Provisioning with the Claim method. I've been closely following the instructions in the repository "https://github.com/NordicPlayground/aws-iot-core-fleet-provisioning-with-nrf9160".

Here's a breakdown of my progress and where I'm facing issues:

Steps Completed:

  1. Certificate and Key Generation: Successfully generated a provisioning certificate and private key.
  2. Connectivity Test: Established a connection with AWS IoT Core using the generated certificate and key with the "Fleet-Provisioning-for-AWS-IoT-embedded-sdk" project. I was able to receive the provisioning certificate and the private key when running the fleet_provisioning_keys_cert demo (running natively on Ubuntu).

Issue: I'm unable to complete the Fleet Provisioning process with the claim method when using the same generated credentials with Thingy91. I'm unsure where the issue lies within the provisioning flow.

Device and Software Details:

  • Device: Thingy91
  • Modem Firmware Version: v1.3.5
  • nRF Connect SDK Version: v2.5.2

Could you kindly help recommend known issues or specific configuration steps I might be missing in the Fleet Provisioning flow for the Thingy91. I would like to attach the project config file, log message console and the modem trace that I collected from the RTT. Thank you in advance for your expertise and assistance.

Sincerely,
Thuan.



0728.RTTLogger_Channel_modem_trace.log

  • Fleet provisioning requires the device to interact with AWS' provisioning MQTT API: https://docs.aws.amazon.com/iot/latest/developerguide/fleet-provision-api.html

    This is not implement in nRF Connect SDK and you have to implement this yourself.

  • Thank you for the information Markus, from my understanding, it's just about connecting to AWS using claim credentials and then subscribing and publishing to a specified topic to obtain a new certificate and private key. I've connected to AWS using the claim credentials generated from the workaround (https://github.com/NordicPlayground/aws-iot-core-fleet-provisioning-with-nrf9160) using AWS-IOT-SDK-C, but I can't connect to AWS IoT using the same claim credentials with my thing91 and nRF connect SDK (connection_poll_start failed, error: -119 or Cloud MQTT input error: -128)

  • Please have a look at the policy, it only allows the device to publish and subscribe to a specific topic.

    However, your firmware configuration of aws_iot causes the application to subscribe and publish to other topics as well.

    Because this is not allowed by the provisioning credentials policy, the connection gets terminated.

  • Hello Markus,
    Thank you for your prompt reply. I tried to turn off subscribing for all possible topics (shadow + application topics) and comment on all the code that might be published to the AWS IoT but the problem remains (Cloud MQTT input error: -128)


    I also read some posts about the "Cloud MQTT input error: -128" and found out there is a high chance there is a problem with the certificate. So I take some other attempts.

    1. I tried and was able to connect to AWS IoT (different regions and credentials) with my Thingy91 to make sure there were no problems with the hardware and cellular connection.

    2. I loaded the claim certificate generated from the workaround to my ESP32 project as well as the fleet provisioning demo using AWS-IOT-SDK-C and was able to make them connect to the AWS IoT. I also go 1 step further by checking the credentials stored inside my thingy91 by comparing the SHA256 of the CA cert, device cert, and private key.

    Could you please help take a look at the following details:

    thingy91_aws_trace.log

    Kconfig changes belong with comment all publish/subscribe calls:
  • Please consult the AWS IoT Lifecycle events for your device to see what causes the disconnect: docs.aws.amazon.com/.../life-cycle-events.html

1 2