Is there any step by step instruction for onboarding process ?

[FlashBack123]

So, I have built prototype boards using nrf9160, flashed, they are working fine, now need to add to nrf Cloud and realized there are few ways to do that, all are not well described.

Is there any easy way to add device using web interface (with no digging into API part) ? When I just add device I get code 40411.

Will highly appreciate if there is step by step easy to follow short instruction how to set that up (including certificates to be added device side if needed)

[justin]

The provisioning service (and the nRF Cloud Provisioning Sample) are not compatible with the nRF9160.
You will need to use either use JITP or Preconnect.

JITP may be sufficient for initial device testing, but is not recommended for production devices.

• To download credentials, click "Create JITP Certificates" on the https://nrfcloud.com/#/add-device/lte-device page.
• Input your device ID and create a PIN... click the download button.
• Use the Cellular Monitor application to load the downloaded JSON file and write the credentials to your device.
• Allow your device to connect to nRF Cloud... on the first connection, the device will be disconnected as JITP is performed.  Wait a few seconds...
• On the https://nrfcloud.com/#/add-device/lte-device page, enter your device ID and PIN, and click the add button.
• You should now see your device in the list https://nrfcloud.com/#/devices 
  • On the next connection attempt, your device should successfully connect and interact with nRF Cloud.

Preconnect is the recommended method. You can securely generate a private key on your device using an AT command and then create a device certificate. The steps are detailed here.  We have a python script that performs the required steps and outputs a CSV file to be uploaded to the website to onboard your devices.

• Clone the utils repo: https://github.com/nRFCloud/utils.git
• Navigate to utils/python/modem-firmware-1.3+ and install the required python packages: 
  • https://github.com/nRFCloud/utils/tree/master/python/modem-firmware-1.3%2B#prerequisites 
• Create a CA cert using create_ca_cert.py: https://github.com/nRFCloud/utils/tree/master/python/modem-firmware-1.3%2B#create-ca-cert
  • This only needs to be done once, you can use the created CA cert for all of your devices.
• Generate and install credentials on your device using device_credentials_installer.py: https://github.com/nRFCloud/utils/tree/master/python/modem-firmware-1.3%2B#device-credentials-installer
  • Use the files created by create_ca_cert.py for the script parameters --ca and --ca_key.
  • To see all the available option parameters, execute: python3 device_credentials_installer.py --help
• Upload the generated CSV file (default: onboard.csv) to the website: https://nrfcloud.com/#/add-device/bulk and click onboard.
  • You can check the status of the onboarding by navigating to https://nrfcloud.com/#/bulk-operation-history
• Successfully onboarded devices will now appear in https://nrfcloud.com/#/devices 
• Devices can now connect and interact with nRF Cloud
  

[FlashBack123]

So, here is big issue - these methods require action with each device.

But if we have situation, where we have let's say 5000 device batch from factory, with USB bridge stripped to save cost, assembled in IP67 case - there is no way to do way described above. There shall be solution to add devices just on server side using their ID (in most cases IMEI), otherwise that is impossible for mass production and deployment...

[Markus Tacker (he/him)]

How would you program such a device with firmware?

[FlashBack123]

With Segger over SWD on factory

[Markus Tacker (he/him)]

So you actually have the means to program a firmware with the AT host and create certificates in production.

[Markus Tacker (he/him)]

I believe what you would like to have is to have devices just flashed with a provisioning certificate, which is the same for all devices, and then when they later connect, the individual device certificate is provisioned while the device is onboarded to your nRF Cloud account.

To my knowledge a process like this does not exists for the nRF9160.

The security services that enable this through the use of the attestation token only work with an nRF91x1 device.

[FlashBack123]

Well, that is exactly issue, to reduce operations to minimum, as on factory side and on deployment stage. If certificate can be dropped into firmware and used all same always, without per device alteration, that is viable option.