Connecting to Azure Iot Hub fails at device certificates

[Byter]

We're trying to connect to our Azure Iot Hub using the Azure Iot Hub library provided by Nrf Connect Sdk 2.6.0 (without DPS). We're currently using the evaluation board to test this. The error we get once we try to connect using the azure_iot_hub sample is this:

[00:00:04.760,253] <inf> azure_iot_hub_sample: Azure IoT Hub library initialized
[00:00:04.760,284] <inf> azure_iot_hub_sample: AZURE_IOT_HUB_EVT_CONNECTING
+CGEV: IPV6 0
[00:00:06.821,380] <inf> azure_iot_hub_sample: Connection request sent to IoT Hub
[00:00:07.057,739] <err> azure_iot_hub: Connection was rejected with return code 5
[00:00:07.057,739] <wrn> azure_iot_hub: Is the device certificate valid?
[00:00:07.057,769] <inf> azure_iot_hub_sample: AZURE_IOT_HUB_EVT_CONNECTION_FAILED
[00:00:07.057,769] <inf> azure_iot_hub_sample: Error code received from IoT Hub: 5
[00:00:07.058,929] <wrn> azure_iot_hub: DISCONNECT, result: -111
[00:00:07.058,959] <inf> azure_iot_hub_sample: AZURE_IOT_HUB_EVT_DISCONNECTED
[00:00:07.058,959] <err> mqtt_helper: Cloud MQTT input error: -111

So it seems like the issue is with the device certificates. However, I followed the documentation multiple times 1:1 so it's weird. Here is what I've tried so far:

• Follow the documentation at: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/2.6.0/nrf/libraries/networking/azure_iot_hub.html both at 2.5.0 and 2.6.0
• Try to connect to azure through our code and your azure_iot_hub sample
• Use nrfcredstore to add the certificates to the device
• Use Cellular Monitor from Nrf Connect Sdk for Desktop to add the certificates to the device
• Follow Microsoft's guide which I've found from the following thread: https://devzone.nordicsemi.com/f/nordic-q-a/106640/api-registration-of-certification-for-azure-iot-hub-dps
• Use Baltimore instead of DigiCert for the root certificate
• Switch between the first and secondary security tags (and change their numbers in general)

Here is a pastebin for the certification process (using nrfcredstore): https://pastebin.com/gx4Ahrcd

Any help would be appreciated

[Hakon]

Hello,

Use nrfcredstore to add the certificates to the device

What certificates did you write to the modem? Have you tried reading them out with at%cmng?

[Byter]

Hey, I meant using the nrfcredstore method from the documentation. Meaning I wrote the certificates that were generated from the cmd tool.

Unless nrfcredstore uses the at%cmng command behind the scenes of nrfcredstore COM3 list, I haven't tried it

[Hakon]

You can use the command to read out the certificates, so you know that they have been written to the modem.

[Byter]

The certificates have been indeed written into the modem

[Hakon]

Then maybe if you did a modem trace that would indicate what's wrong.

[Byter]

I'm not proficient with the TLS handshake but by reading a few articles it seems like it finishes the handshake and only after it fails. Unless I'm understanding it incorrectly.

EDIT: I've now found that "Encrypted Alert" means "Decryption Failed" so I'm digging more into that

Okay so that's indeed an issue with the certificates. The issue is figuring where it went wrong because I followed the docs a couple of times already. Is there some azure iot hub configuration that I should share?

[Hakon]

Byter said:

Is there some azure iot hub configuration that I should share?

I don't know. Have you tried contacting Azure support team? Perhaps they have more insight into what is going on.

[Byter]

I'll try. Right now I don't have access to the azure support from my account because of where we created it from. So you're saying that you don't see anything abnormal with the terminal session and in general?

[Byter]

I got it working. What I did was follow this tutorial from Microsoft again but this time, instead of using the device id (CN) like the tutorial from Nordic, I used device##. This means that the evaluation board is able to connect using certificates but following the official tutorial from Nordic didn't work. My guess is that the issue is with the CN, that nrfcredstore uses by default is invalid in some sort of way. In case it's different than the usual, for me it was something like: #####-####-########-### (not exact number of #'s) that instead of # there was a letter or a number. And somehow this string was either invalid as a CN or as a device name for Azure Iot Hub. Whatever it was, it's working now so this issue can be marked as resolved

P.S. There's always the chance that I did something wrong each time I tried but the last time