Difficulty Provisioning Thingy91 to AWS IoT Fleet Provisioning (Claim Method)

RE: Difficulty Provisioning Thingy91 to AWS IoT Fleet Provisioning (Claim Method)

Muneeb ur Rehman — Fri, 11 Apr 2025 14:29:47 GMT

Hi Waqar Ahmed ,
Were you able to figure out the issue with the mqtt connect error -128
I am facing the similar issues The same certificates i am using for subscribing or connecting to any other topic it works for connection well however mqtt input error occurs if i try subscribing to the fleet provision
topic ?

Is there any specific reason for it
Thanks in advance

RE: Difficulty Provisioning Thingy91 to AWS IoT Fleet Provisioning (Claim Method)

Markus Tacker (he/him) — Fri, 25 Oct 2024 11:09:48 GMT

Please follow the instructions how how to retrieve more debug information above.

RE: Difficulty Provisioning Thingy91 to AWS IoT Fleet Provisioning (Claim Method)

Waqar Ahmed — Fri, 25 Oct 2024 09:44:22 GMT

Hi ltachiVN,
1. I am facing same issue and following the same process and getting the same error.
have you found the reason for this error?

please let me know

RE: Difficulty Provisioning Thingy91 to AWS IoT Fleet Provisioning (Claim Method)

Markus Tacker (he/him) — Sun, 24 Mar 2024 21:33:45 GMT

Also, please make sure to use the correct secTag when writing the credentials.

RE: Difficulty Provisioning Thingy91 to AWS IoT Fleet Provisioning (Claim Method)

Markus Tacker (he/him) — Sun, 24 Mar 2024 21:33:07 GMT

Please consult the AWS IoT Lifecycle events for your device to see what causes the disconnect: docs.aws.amazon.com/.../life-cycle-events.html

RE: Difficulty Provisioning Thingy91 to AWS IoT Fleet Provisioning (Claim Method)

ItachiVN — Sat, 23 Mar 2024 11:05:09 GMT

Hello Markus,
Thank you for your prompt reply. I tried to turn off subscribing for all possible topics (shadow + application topics) and comment on all the code that might be published to the AWS IoT but the problem remains (Cloud MQTT input error: -128)

I also read some posts about the "Cloud MQTT input error: -128" and found out there is a high chance there is a problem with the certificate. So I take some other attempts.

1. I tried and was able to connect to AWS IoT (different regions and credentials) with my Thingy91 to make sure there were no problems with the hardware and cellular connection.

2. I loaded the claim certificate generated from the workaround to my ESP32 project as well as the fleet provisioning demo using AWS-IOT-SDK-C and was able to make them connect to the AWS IoT. I also go 1 step further by checking the credentials stored inside my thingy91 by comparing the SHA256 of the CA cert, device cert, and private key.

Could you please help take a look at the following details:

devzone.nordicsemi.com/.../thingy91_5F00_aws_5F00_trace.log
devzone.nordicsemi.com/.../3603.device_5F00_log.txt
Kconfig changes belong with comment all publish/subscribe calls:

# Additional Kconfig options
CONFIG_AWS_IOT_AUTO_DEVICE_SHADOW_REQUEST=n
CONFIG_AWS_IOT_TOPIC_GET_ACCEPTED_SUBSCRIBE=n
CONFIG_AWS_IOT_TOPIC_GET_REJECTED_SUBSCRIBE=n
CONFIG_AWS_IOT_TOPIC_UPDATE_DELTA_SUBSCRIBE=n
CONFIG_MQTT_CLEAN_SESSION=y

RE: Difficulty Provisioning Thingy91 to AWS IoT Fleet Provisioning (Claim Method)

Markus Tacker (he/him) — Fri, 22 Mar 2024 08:20:24 GMT

Please have a look at the policy, it only allows the device to publish and subscribe to a specific topic.

However, your firmware configuration of aws_iot causes the application to subscribe and publish to other topics as well.

Because this is not allowed by the provisioning credentials policy, the connection gets terminated.

RE: Difficulty Provisioning Thingy91 to AWS IoT Fleet Provisioning (Claim Method)

ItachiVN — Thu, 21 Mar 2024 23:47:51 GMT

Thank you for the information Markus, from my understanding, it's just about connecting to AWS using claim credentials and then subscribing and publishing to a specified topic to obtain a new certificate and private key. I've connected to AWS using the claim credentials generated from the workaround (https://github.com/NordicPlayground/aws-iot-core-fleet-provisioning-with-nrf9160) using AWS-IOT-SDK-C, but I can't connect to AWS IoT using the same claim credentials with my thing91 and nRF connect SDK (connection_poll_start failed, error: -119 or Cloud MQTT input error: -128)

RE: Difficulty Provisioning Thingy91 to AWS IoT Fleet Provisioning (Claim Method)

Markus Tacker (he/him) — Thu, 21 Mar 2024 14:52:20 GMT

Fleet provisioning requires the device to interact with AWS' provisioning MQTT API: https://docs.aws.amazon.com/iot/latest/developerguide/fleet-provision-api.html

This is not implement in nRF Connect SDK and you have to implement this yourself.