Having trouble trying to convert cbor object to CSR while trying to provision a device

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

witch_mountain — Tue, 30 Jul 2024 12:34:43 GMT

Hi Priyanka!

Thank you so much for your help! That seemed to have fixed the issue with my device. Initially I was trying to connect with the asset_tracker_v2_nbiotlegacy application but it seems that NB-IoT coverage isn't particularly strong in my area but I was able to connect my device to nRF Cloud over LTE!

This ticket can be closed, thanks :)

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

Priyanka — Tue, 30 Jul 2024 07:23:20 GMT

Hi,

I have heard from our team. Your device nrf-352656100884728 does not exist in nrf cloud, so that means it has never successfully connected to perform JITP. This is why you are not able to associate your device.

So either the device has never been able to establish a network connection to successfully connect to the cloud or the credentials on the device are invalid/not formatted correctly.

According to your device, you can onboard the device as follows:

1. preconnect provisioning

2. JITP
Before continuing further, please choose any one option.

We recommend that you first attempt to use JITP to avoid your script/computer setup issues.

This process is summarized as follows:

- In Serial Terminal, select your device.
- Send AT+CFUN=4
- Confirm setting with AT+CFUN?
- In Cellular Monitor, select your device.
- Navigate to Certificate Manager.
- Click the Load from JSON button.
- Select the JSON file downloaded from nRF Cloud.
- Click Update Certificates.
- Confirm in Cellular Monitor log that all three credentials were deleted and updated.
- You can also confirm in Serial Terminal that the data was sent.

Here are some screenshots of the process:

After your credentials are updated, you can cycle power on the device.
When it first attempts to connect to nRF Cloud, you will see:

[00:01:24.234,832] <err> nrf_cloud_transport: MQTT input error: -128
[00:01:24.234,924] <err> nrf_cloud_transport: Error disconnecting from cloud: -128
[00:01:24.235,015] <inf> app_event_manager: CLOUD_EVT_DISCONNECTED

This is a normal part of the JITP process.
Once you see this, you can proceed to nRF Cloud and add the device to your account.
The device should connect successfully on the next retry.

-Priyanka

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

witch_mountain — Thu, 25 Jul 2024 12:06:47 GMT

Hi Priyanka!

[quote userid="107729" url="~/f/nordic-q-a/113202/having-trouble-trying-to-convert-cbor-object-to-csr-while-trying-to-provision-a-device/495526"]You don't need to use curl to do that, and even if you did so, it would very likely fail with the same error 40412.[/quote]

Just to clarify but the reason the Associate Device Endpoint didn't work at least in my case would be attributed to the fact that the device technically is already "provisioned" because of it's factory settings. If I were trying to add a non-nrf device to nRF Cloud then would this method have worked?

Thanks!

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

Priyanka — Thu, 25 Jul 2024 10:53:06 GMT

Thank you very much. We are working on this.

-Priyanka

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

witch_mountain — Thu, 25 Jul 2024 10:30:21 GMT

Hi Priyanka!

The IMEI = nrf-352656100884728

The PIN = 315202

Thank you again for the help!

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

Priyanka — Thu, 25 Jul 2024 04:33:38 GMT

Hi,

Could you share the IMEI and PIN so we can investigate further from our end?

[quote user="witch_mountain"]

Specifically the section about "Using the LTE Link Monitor Certificate manager". I couldn't find where this LTE Link Monitor application was so I used the Cellular Monitor from nRF Connect for Desktop and used the Certificate Manager there to add my JSON file and update my certificate. This however did not work when I went back to add a new device to nRF Cloud as I received the same 40412 error.

Then I went back to: https://api.nrfcloud.com/v1/#tag/IP-Devices/operation/CreateDeviceCertificate just to fully read what is provided in this section and if there was anything else I could consider trying. That's where I came upon that one of the disadvantages of this endpoint was that I had to "You will have to explicitly associate a JITP device with your account". There was a hyperlink attached to "associate" that lead me to: https://api.nrfcloud.com/v1#tag/IP-Devices/operation/AssociateDevice

[/quote]

Yes, it's true that the documentation still mentions LTE Link Monitor and we are aware of this. Our tech writer is working on the updates to that page. When you got the 40412 error, that was as a result of trying to associate your device. You don't need to use curl to do that, and even if you did so, it would very likely fail with the same error 40412.

-Priyanka

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

witch_mountain — Wed, 24 Jul 2024 13:55:45 GMT

Thanks so much Priyanka, I'm looking forward to hear their input and advice!

I also wanted to add that I tried 2 other methods as of recently to try adding my device/generating certificates that I wanted to share so the Cloud team has a better understanding of what methods I've gone through.

I first tried using the Create JITP Certificate option found on nRF Cloud when adding in a new device. As shown here:

After inputting my devices IMEI and PIN and downloaded the JSON file with my certificate I followed the guide from: https://docs.nordicsemi.com/bundle/nrf-cloud/page/Devices/Security/Credentials.html#using-the-lte-link-monitor-certificate-manager

Following this endpoint I tried to use the cmd

curl -X PUT $API_HOST/v1/association/$DEVICE_ID -d "$DEVICE_OWNERSHIP_CODE" -H "Authorization: Bearer $API_KEY" -H "Content-Type: text/plain"

When I inputted this into my cmd prompt, where I added in my device id, PIN, api key I received this error message:

curl: (35) schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate.

I would like to also add that I'm not fully sure if my $API_HOST was correct as I used: https://api.nrfcloud.com/v1/openapi.json

I'm at the moment trying to fix this and if there are any suggestions I'd love to hear them! Again, thank you for the help as you look into my problem and I just wanted to provide some more information/update my various attempts at finding a solution!

Cheers!

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

Priyanka — Wed, 24 Jul 2024 06:54:15 GMT

Thank you for the detailed description. I have conveyed this to the Cloud team and will get back to you soon.

-Priyanka

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

witch_mountain — Tue, 23 Jul 2024 12:13:44 GMT

Hi Priyanka!

This issue all began when I tried to add my device like you described on nRF Cloud with the IMEI and PIN from the sticker on the device. I received this message:

And when I checked to see what nRF Code 40412 meant from https://api.nrfcloud.com/v1/

I had the options to resolve this by:

Checking to make sure my entered values where correct-- they were
Check the LED status to see if it was provisioned-- I had flashed the required firmware for the nRF 91 SiP and the nRF52 SoC and had the asset tracker v2 application flashed so my Thingy 91 device was glowing green when turned on
(Re-)flash the latest modem firmware-- Reflashed the latest modem firmware off the Nordic Thingy 91 page and seems to be in working order
Move to a location with a better LTE connection. -- Had done this as well
Flash new device certificates obtained from the CreateDeviceCertificate endpoint.

My last option from that list was to flash the new device certificate where I was taken to this link: https://api.nrfcloud.com/v1/#tag/IP-Devices/operation/CreateDeviceCertificate

But since this endpoint was deprecated I followed it to the Onboard Device endpoint: https://api.nrfcloud.com/v1/#tag/IP-Devices/operation/OnboardDevice

Where I tried to get more information from the Onboarding page off the nRF Cloud Documentation https://docs.nordicsemi.com/bundle/nrf-cloud/page/Devices/Associations/Provisioning.html

And this is where I found the Just-In-Time Provisioning and realized that my error message specifically mentioned that. Then from that page I was taken to:

https://docs.nordicsemi.com/bundle/nrf-cloud/page/Devices/Security/Credentials.html

and learned how to Generating credentials using AT commands which where I am at now.

I am new to using nordic devices and nRF Cloud so if this was not the list of steps I was supposed to take please let me know. I'm just following through the researching through the documentation provided by Nordic Semiconductors on their products.

Thanks!

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

Priyanka — Tue, 23 Jul 2024 07:21:28 GMT

Hi,

This is what I hear from the team:

If you are truly wanting to "Just In Time Provision" (JITP), the modem_credentials_parser.py is not used at all. JITP means you want to use the certificates written by the factory into the modem in their Thingy:91, then use the Add LTE Device form on nRF Cloud to add it to their account.

All you need are the IMEI and PIN from the sticker on the Thingy:91 PCB. Then in nRF Cloud, with the Thingy:91 turned on, go to Device Management -> Devices -> Add Device -> LTE Device -> Enter the device ID as nrf-<IMEI from sticker> and the PIN from the sticker; subtype can be left empty. Then tap Add Device.

Hope this helps.

-Priyanka

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

witch_mountain — Mon, 22 Jul 2024 15:02:16 GMT

Hi Priyanka!

I'm accessing this through a work network and I've been in contact with my IT department and I was able to work through some of my issues and am now in this new position:

After being able to configure pip to the CA certificate associated with my place of work I was able to create a virtual environment and update pip to the latest version without throwing an SSL error. I've added this new environment to my PATH and then tried to install my requirements.txt file in order to use the python script associated with my initial task ;-;

When I enter pip install -r requirements.txt I get the following error:

Looking in indexes: /*WORK LINK*/
Collecting auto_mix_prep>=0.2.0 (from -r requirements.txt (line 1))
Using cached /*WORK LINK*/ s ... done
Getting requirements to build wheel ... done
Preparing metadata (pyproject.toml) ... done
Collecting cbor2>=5.4.2.post1 (from -r requirements.txt (line 2))
Using cached /*WORK LINK*/ (23 kB)
Collecting colorama>=0.4.4 (from -r requirements.txt (line 3))
Using cached /*WORK LINK*/ (25 kB)
Collecting cryptography>=36.0.1 (from -r requirements.txt (line 4))
Using cached /*WORK LINK*/ (686 kB)
Installing build dependencies ... error
error: subprocess-exited-with-error

× pip subprocess to install build dependencies did not run successfully.
│ exit code: 1
╰─> [142 lines of output]
Looking in indexes: /*WORK LINK*/
Collecting maturin<2,>=1
Using cached /*WORK LINK*/ (188 kB)
Installing build dependencies: started
Installing build dependencies: finished with status 'done'
Getting requirements to build wheel: started
Getting requirements to build wheel: finished with status 'done'
Preparing metadata (pyproject.toml): started
Preparing metadata (pyproject.toml): finished with status 'done'
Collecting cffi>=1.12
Using cached /*WORK LINK*/ (512 kB)
Installing build dependencies: started
Installing build dependencies: finished with status 'done'
Getting requirements to build wheel: started
Getting requirements to build wheel: finished with status 'done'
Preparing metadata (pyproject.toml): started
Preparing metadata (pyproject.toml): finished with status 'done'
Collecting setuptools
Using cached https:/*WORK LINK*/ (2.3 MB)
Collecting pycparser (from cffi>=1.12)
Using cached /*WORK LINK*/ (117 kB)
Building wheels for collected packages: maturin, cffi
Building wheel for maturin (pyproject.toml): started
Building wheel for maturin (pyproject.toml): finished with status 'error'
error: subprocess-exited-with-error

Building wheel for maturin (pyproject.toml) did not run successfully.
exit code: 1

[42 lines of output]
C:\Users\rbx5032\AppData\Local\Temp\pip-build-env-p7nrk207\overlay\lib\python3.11\site-packages\setuptools\config\_apply_pyprojecttoml.py:79: SetuptoolsWarning: `install_requires` overwritten in `pyproject.toml` (dependencies)
corresp(dist, value, root_dir)
running bdist_wheel
running build
running build_py
creating build
creating build\lib.mingw_x86_64-cpython-311
creating build\lib.mingw_x86_64-cpython-311\maturin
copying maturin\__init__.py -> build\lib.mingw_x86_64-cpython-311\maturin
copying maturin\__main__.py -> build\lib.mingw_x86_64-cpython-311\maturin
running egg_info
creating maturin.egg-info
writing maturin.egg-info\PKG-INFO
writing dependency_links to maturin.egg-info\dependency_links.txt
writing requirements to maturin.egg-info\requires.txt
writing top-level names to maturin.egg-info\top_level.txt
writing manifest file 'maturin.egg-info\SOURCES.txt'
reading manifest file 'maturin.egg-info\SOURCES.txt'
reading manifest template 'MANIFEST.in'
warning: no files found matching '*.json' under directory 'src\python_interpreter'
adding license file 'license-apache'
adding license file 'license-mit'
writing manifest file 'maturin.egg-info\SOURCES.txt'
running build_ext
running build_rust
Updating crates.io index
warning: spurious network error (3 tries remaining): [35] SSL connect error (schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate.)
warning: spurious network error (2 tries remaining): [35] SSL connect error (schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate.)
warning: spurious network error (1 tries remaining): [35] SSL connect error (schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate.)
error: failed to get `anyhow` as a dependency of package `maturin v1.7.0 (C:\Users\rbx5032\AppData\Local\Temp\pip-install-8tl9iopx\maturin_c7d66aa104f340d6a8375f29f177aa7a)`

Caused by:
download of config.json failed

Caused by:
failed to download from `https://index.crates.io/config.json`

Caused by:
[35] SSL connect error (schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate.)
error: `cargo metadata --manifest-path Cargo.toml --format-version 1 --locked` failed with code 101
-- Output captured from stdout:

[end of output]

note: This error originates from a subprocess, and is likely not a problem with pip.
ERROR: Failed building wheel for maturin
Building wheel for cffi (pyproject.toml): started
Building wheel for cffi (pyproject.toml): finished with status 'error'
error: subprocess-exited-with-error

Building wheel for cffi (pyproject.toml) did not run successfully.
exit code: 1

[52 lines of output]
_configtest.c:2:2: error: #error "not MSVC"
2 | #error "not MSVC"
| ^~~~~
Note: will not use '__thread' in the C code
***** The above error message can be safely ignored.

running bdist_wheel
running build
running build_py
creating build
creating build\lib.mingw_x86_64-cpython-311
creating build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\api.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\backend_ctypes.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\cffi_opcode.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\commontypes.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\cparser.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\error.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\ffiplatform.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\lock.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\model.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\pkgconfig.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\recompiler.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\setuptools_ext.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\vengine_cpy.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\vengine_gen.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\verifier.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\_imp_emulation.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\_shimmed_dist_utils.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\__init__.py -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\_cffi_include.h -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\parse_c_type.h -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\_embedding.h -> build\lib.mingw_x86_64-cpython-311\cffi
copying src\cffi\_cffi_errors.h -> build\lib.mingw_x86_64-cpython-311\cffi
running build_ext
building '_cffi_backend' extension
creating build\temp.mingw_x86_64-cpython-311
creating build\temp.mingw_x86_64-cpython-311\src
creating build\temp.mingw_x86_64-cpython-311\src\c
gcc -DNDEBUG -g -fwrapv -O3 -Wall -march=nocona -msahf -mtune=generic -O2 -pipe -Wp,-D_FORTIFY_SOURCE=2 -fstack-protector-strong -O3 -march=nocona -msahf -mtune=generic -O2 -pipe -Wp,-D_FORTIFY_SOURCE=2 -fstack-protector-strong -O3 -DFFI_BUILDING=1 -IC:/msys64/mingw64/bin/../include -IC:\msys64\mingw64/include/python3.11 -c src/c/_cffi_backend.c -o build\temp.mingw_x86_64-cpython-311\src\c\_cffi_backend.o
src/c/_cffi_backend.c: In function 'b_do_dlopen':
src/c/_cffi_backend.c:4521:40: error: passing argument 1 of 'PyUnicode_AsWideChar' from incompatible pointer type [-Wincompatible-pointer-types]
4521 | sz1 = PyUnicode_AsWideChar((PyUnicodeObject *)filename_unicode,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| PyUnicodeObject *
In file included from C:\msys64\mingw64/include/python3.11/Python.h:51,
from src/c/_cffi_backend.c:2:
C:\msys64\mingw64/include/python3.11/unicodeobject.h:299:15: note: expected 'PyObject *' {aka 'struct _object *'} but argument is of type 'PyUnicodeObject *'
299 | PyObject *unicode, /* Unicode object */
| ~~~~~~~~~~^~~~~~~
error: command 'C:\\msys64\\mingw64\\bin\\gcc.EXE' failed with exit code 1
[end of output]

note: This error originates from a subprocess, and is likely not a problem with pip.
ERROR: Failed building wheel for cffi
Failed to build maturin cffi
ERROR: ERROR: Failed to build installable wheels for some pyproject.toml based projects (maturin, cffi)
[end of output]

note: This error originates from a subprocess, and is likely not a problem with pip.
error: subprocess-exited-with-error

× pip subprocess to install build dependencies did not run successfully.
│ exit code: 1
╰─> See above for output.

note: This error originates from a subprocess, and is likely not a problem with pip.

I was wondering if there was something else I'm missing when I try to install the requirements for the scripts needed.

Thanks!

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

Priyanka — Mon, 22 Jul 2024 13:49:56 GMT

Hi,

The issue may arise if you are using a firewall. Maybe you could try using an unrestricted firewall and see if this helps.

-Priyanka

RE: Having trouble trying to convert cbor object to CSR while trying to provision a device

Priyanka — Mon, 22 Jul 2024 13:22:05 GMT

Hi,

I have inquired internally regarding the issue and will get back to you soon.

Regards,

Priyanka