Cannot connect to Azure IoT, Failed to run DPS, error: -14, Cloud MQTT input error: -111

[srubin-ns]

Hello. I am working through the tutorial Azure IoT Hub trying to connect our board to an Azure IoT Hub using DPS. Things seem to work up until the point where our board actually authenticates to DPS. Please see the log below.

I have a suspicion that the problem might be caused by one of the following:

- It's not clear if I need to use the same "sec num" (in my case 1000) for all of the connected root CA, client cert, and client keys. I have tried it with unique numbers as well (1000, 1001, 1002). 

- It's also not clear to me which item CONFIG_MQTT_HELPER_SEC_TAG should point to - my cert, the root CA, or what.

Here are my artifacts provisioned in the modem:

> nrfcredstore COM24 list
Secure tag Key type SHA
1000 ROOT_CA_CERT 0E0A61E2E78D28EEA66B15A9B10C1F4E5E8AD379FEA9131D02EC4A2473F9AB9C
1000 CLIENT_CERT 6CD3B2F0C55FABCA3F5E13E88BC4A1132AFBA0E6BCD8722E4CFECE691769D8EB
1000 CLIENT_KEY 4020F5275049882F2C6CDD70B950A92A5938D5EC93F64509C3FD05CEC3722786
1001 ROOT_CA_CERT 44866CF6914A1AD1100147FA8432387FD5E63A5B5DFDD5A967A507AFEB78639B
4294967292 NORDIC_PUB_KEY 672E2F05962B4EFBFA8801255D87E0E0418F2DDF4DDAEFC59E9B4162F512CB63
4294967293 NORDIC_ID_ROOT_CA 2C43952EE9E000FF2ACC4E2ED0897C0A72AD5FA72C3D934E81741CBD54F05BD1
4294967294 DEV_ID_PUB_KEY 27E32A71C653FE9FC2A933A26619921D04F6D6CED3F0AD910BF539A3AF8F90C1

Here are some configuration snippets:

# Azure IoT Hub library

CONFIG_AZURE_IOT_HUB=y

CONFIG_AZURE_IOT_HUB_SAMPLE_DEVICE_ID_USE_HW_ID=y

CONFIG_AZURE_IOT_HUB_DEVICE_ID="sfr-XXX-test-device"

# Host name must be configured if DPS is not used

CONFIG_AZURE_IOT_HUB_HOSTNAME=""

# Change the security tag to the tag where Azure IoT Hub certificates

# are provisioned

CONFIG_MQTT_HELPER_SEC_TAG=1000

CONFIG_MQTT_HELPER_SECONDARY_SEC_TAG=1001

CONFIG_MQTT_HELPER_STACK_SIZE=8192

# Azure IoT Hub / Device Provision Service (DPS)

CONFIG_AZURE_IOT_HUB_DPS=y

# CONFIG_AZURE_IOT_HUB_DPS_REG_ID=""

CONFIG_AZURE_IOT_HUB_DPS_ID_SCOPE="0ne00ED928B"

CONFIG_MODEM_JWT=y

CONFIG_HW_ID_LIBRARY_SOURCE_UUID=y

Log:

00> *** Booting nRF Connect SDK v2.9.99-b957011b12c4 ***
00> *** Using Zephyr OS v3.7.99-a7fe5f7c4aab ***
00> [00:00:00.252,410] <inf> azure_iot_hub_sample: *******************************************
00> [00:00:00.252,502] <inf> azure_iot_hub_sample: **** DPS ID Scope "0ne00ED928B"
00> [00:00:00.252,502] <inf> azure_iot_hub_sample: **** CONFIG_MQTT_HELPER_SEC_TAG "1000"
00> [00:00:00.252,532] <inf> azure_iot_hub_sample: *******************************************
00> [00:00:00.252,532] <inf> azure_iot_hub_sample: Azure IoT Hub sample started
00> [00:00:00.252,563] <inf> azure_iot_hub_sample: Bringing network interface up and connecting to the network
00> [00:00:00.671,844] <inf> azure_iot_hub_sample: Device ID: 5034474b-3731-4ae0-8046-252272655e2e
00> [00:00:06.855,682] <inf> azure_iot_hub_sample: Network connectivity established and IP address assigned
00> [00:00:06.855,712] <inf> azure_iot_hub_sample: ====== Cell Network Info ======
00> [00:00:06.856,506] <inf> azure_iot_hub_sample: Signal strength: 53
00> [00:00:06.857,269] <inf> azure_iot_hub_sample: Current LTE band: 12
00> [00:00:06.857,849] <inf> azure_iot_hub_sample: Supported LTE bands: (1,2,3,4,5,8,12,13,18,19,20,25,26,28,66,85)
00> --- 4 messages dropped ---
00> [00:00:06.860,626] <inf> azure_iot_hub_sample: IP address of the device: 10.201.136.219
00> [00:00:06.861,358] <inf> azure_iot_hub_sample: Modem firmware version: mfw_nrf91x1_2.0.2
00> [00:00:06.862,213] <inf> azure_iot_hub_sample: LTE-M support mode: 1
00> [00:00:06.862,915] <inf> azure_iot_hub_sample: NB-IoT support mode: 1
00> [00:00:06.863,647] <inf> azure_iot_hub_sample: GPS support mode: 0
00> [00:00:06.864,562] <inf> azure_iot_hub_sample: Mobile network time and date: 25/03/25,21:28:18-16
00> [00:00:06.864,593] <inf> azure_iot_hub_sample: ===============================
00> [00:00:06.864,685] <inf> azure_iot_hub_sample: Connected to network
00> [00:00:06.864,715] <inf> azure_iot_hub_sample: Starting DPS
00> [00:00:06.864,776] <dbg> azure_iot_hub_dps: dps_reg_id_set: Setting DPS registration ID: 5034474b-3731-4ae0-8046-252272655e2e
00> [00:00:06.864,807] <dbg> azure_iot_hub_dps: dps_id_scope_set: No ID scope provided, using ID scope from Kconfig: 0ne00ED928B
00> [00:00:06.864,837] <dbg> azure_iot_hub_dps: dps_id_scope_set: Setting DPS ID scope: 0ne00ED928B
00> [00:00:06.865,081] <dbg> azure_iot_hub_dps: dps_on_settings_loaded: Settings fully loaded
00> [00:00:06.865,142] <dbg> azure_iot_hub_dps: dps_state_set: State transition: DPS_STATE_UNINIT --> DPS_STATE_DISCONNECTED
00> [00:00:06.865,142] <inf> azure_iot_hub_sample: DPS registration status: AZURE_IOT_HUB_DPS_REG_STATUS_NOT_STARTED
00> [00:00:06.865,234] <dbg> azure_iot_hub_dps: provisioning_client_init: Client ID (size: 36): 5034474b-3731-4ae0-8046-252272655e2e
00> [00:00:06.865,356] <dbg> azure_iot_hub_dps: provisioning_client_init: User name (size: 85): 0ne00ED928B/registrations/5034474b-3731-4ae0-8046-252272655e2e/api-version=2019-03-31
00> [00:00:07.145,080] <dbg> net_mqtt_sock_tls: mqtt_client_tls_connect: (0x2000f6d8): Created socket 0
00> [00:00:09.764,984] <dbg> net_mqtt_sock_tls: mqtt_client_tls_connect: (0x2000f6d8): Connect completed
00> [00:00:09.765,075] <dbg> net_mqtt_enc: connect_request_encode: Encoding Protocol Description.
00> 4d 51 54 54 |MQTT
00> --- 3 messages dropped ---
00> [00:00:09.765,136] <dbg> net_mqtt_enc: pack_uint8: (0x2000f6d8): >> val:04 cur:0x2001362d, end:0x20013722
00> [00:00:09.765,167] <dbg> net_mqtt_enc: pack_uint8: (0x2000f6d8): >> val:00 cur:0x2001362e, end:0x20013722
00> [00:00:09.765,197] <dbg> net_mqtt_enc: connect_request_encode: (0x2000f6d8): Encoding Keep Alive Time 06e7.
00> [00:00:09.765,197] <dbg> net_mqtt_enc: pack_uint16: (0x2000f6d8): >> val:06e7 cur:0x2001362f, end:0x20013722
00> [00:00:09.765,228] <dbg> net_mqtt_enc: connect_request_encode: Encoding Client Id.
00> 35 30 33 34 34 37 34 62 2d 33 37 33 31 2d 34 61 |5034474b -3731-4a
00> 65 30 2d 38 30 34 36 2d 32 35 32 32 37 32 36 35 |e0-8046- 25227265
00> 35 65 32 65 |5e2e
00> [00:00:09.765,289] <dbg> net_mqtt_enc: pack_utf8_str: (0x2000f6d8): >> str_size:00000026 cur:0x20013631, end:0x20013722
00> [00:00:09.765,289] <dbg> net_mqtt_enc: pack_uint16: (0x2000f6d8): >> val:0024 cur:0x20013631, end:0x20013722
00> [00:00:09.765,319] <dbg> net_mqtt_enc: connect_request_encode: Encoding Username.
00> 30 6e 65 30 30 45 44 39 32 38 42 2f 72 65 67 69 |0ne00ED9 28B/regi
00> 73 74 72 61 74 69 6f 6e 73 2f 35 30 33 34 34 37 |stration s/503447
00> 34 62 2d 33 37 33 31 2d 34 61 65 30 2d 38 30 34 |4b-3731- 4ae0-804
00> 36 2d 32 35 32 32 37 32 36 35 35 65 32 65 2f 61 |6-252272 655e2e/a
00> 70 69 2d 76 65 72 73 69 6f 6e 3d 32 30 31 39 2d |pi-versi on=2019-
00> 30 33 2d 33 31 |03-31
00> [00:00:09.765,350] <dbg> net_mqtt_enc: pack_utf8_str: (0x2000f6d8): >> str_size:00000057 cur:0x20013657, end:0x20013722
00> [00:00:09.765,380] <dbg> net_mqtt_enc: pack_uint16: (0x2000f6d8): >> val:0055 cur:0x20013657, end:0x20013722
00> [00:00:09.765,411] <dbg> net_mqtt_enc: mqtt_encode_fixed_header: (0x2000f6d8): << msg type:0x10 length:0x00000087
00> [00:00:09.765,411] <dbg> net_mqtt_enc: packet_length_encode: (0x2000f6d8): >> length:0x00000087 cur:0, end:0
00> [00:00:09.765,441] <dbg> net_mqtt_enc: mqtt_encode_fixed_header: (0x2000f6d8): Fixed header length = 03
00> [00:00:09.765,472] <dbg> net_mqtt_enc: pack_uint8: (0x2000f6d8): >> val:10 cur:0x20013624, end:0x20013722
00> [00:00:09.765,472] <dbg> net_mqtt_enc: packet_length_encode: (0x2000f6d8): >> length:0x00000087 cur:0x20013625, end:0x20013722
00> [00:00:09.766,601] <inf> net_mqtt: Connect completed
00> [00:00:09.766,723] <dbg> azure_iot_hub_dps: dps_state_set: State transition: DPS_STATE_DISCONNECTED --> DPS_STATE_CONNECTING
00> [00:00:09.766,784] <dbg> azure_iot_hub_dps: timeout_work_restart_timer: Restarting timeout: 90 sec
00> [00:00:09.766,815] <inf> azure_iot_hub_sample: The DPS process has started, timeout is set to 90 seconds
00> [00:00:10.137,725] <dbg> net_mqtt: mqtt_input: (0x2000f5c8): state:0x00000002
00> [00:00:10.137,786] <dbg> net_mqtt_dec: unpack_uint8: (0x2000f5c8): >> cur:0x20013722, end:0x20013724
00> [00:00:10.137,817] <dbg> net_mqtt_dec: unpack_uint8: (0x2000f5c8): << val:20
00> [00:00:10.137,847] <dbg> net_mqtt_dec: packet_length_decode: (0x2000f5c8): length:0x00000002
00> [00:00:10.137,939] <dbg> net_mqtt_rx: mqtt_handle_packet: (0x2000f5c8): [CID 0x20010c2c]: Received MQTT_PKT_TYPE_CONNACK!
00> [00:00:10.137,939] <dbg> net_mqtt_dec: unpack_uint8: (0x2000f5c8): >> cur:0x20013724, end:0x20013726
00> [00:00:10.137,969] <dbg> net_mqtt_dec: unpack_uint8: (0x2000f5c8): << val:00
00> [00:00:10.138,000] <dbg> net_mqtt_dec: unpack_uint8: (0x2000f5c8): >> cur:0x20013725, end:0x20013726
00> [00:00:10.138,000] <dbg> net_mqtt_dec: unpack_uint8: (0x2000f5c8): << val:05
00> [00:00:10.138,031] <dbg> net_mqtt_dec: connect_ack_decode: (0x2000f5c8): [CID 0x20010c2c]: session_present_flag: 0
00> [00:00:10.138,061] <dbg> net_mqtt_rx: mqtt_handle_packet: (0x2000f5c8): [CID 0x20010c2c]: return_code: 5
00> [00:00:10.138,092] <err> azure_iot_hub_dps: Connection was rejected with return code 5
00> [00:00:10.138,092] <wrn> azure_iot_hub_dps: Is the device certificate valid?
00> [00:00:10.138,153] <dbg> azure_iot_hub_dps: dps_state_set: State transition: DPS_STATE_CONNECTING --> DPS_STATE_DISCONNECTING
00> [00:00:10.138,153] <dbg> azure_iot_hub_dps: timeout_work_stop: Stopping timeout timer
00> [00:00:10.138,214] <err> mqtt_helper: Library is in the wrong state (MQTT_STATE_DISCONNECTED), MQTT_STATE_CONNECTED required
00> [00:00:10.138,244] <err> azure_iot_hub_dps: Failed to disconnect gracefully, error: -95
00> [00:00:10.138,275] <dbg> azure_iot_hub_dps: dps_state_set: State transition: DPS_STATE_DISCONNECTING --> DPS_STATE_DISCONNECTED
00> [00:00:10.138,336] <err> azure_iot_hub_dps: There was a failure during DPS registration, process is stopped
00> [00:00:10.138,336] <inf> azure_iot_hub_sample: DPS registration status: AZURE_IOT_HUB_DPS_REG_STATUS_FAILED
00> [00:00:10.138,366] <err> azure_iot_hub_sample: Failed to run DPS, error: -14, terminating connection attempt
00> [00:00:10.138,397] <inf> net_mqtt_sock_tcp: Closing socket 0
00> [00:00:10.146,179] <err> mqtt_helper: Cloud MQTT input error: -111

Thank you

[Neso]

I've been unable to get this to work on other boards than nrf9161dk with the Nordic guide. Try using this https://learn.microsoft.com/nb-no/azure/iot-hub/tutorial-x509-test-certs?tabs=windows to generate certificates and cellular monitor to upload them.

[dejans]

Hi srubin-ns ,

There seems to be a certificate problem in your case.
The chosen security tag while provisioning the certificates must be the same as the security tag configured by the CONFIG_MQTT_HELPER_SEC_TAG.
Have you followed the following guides
provisioning Root CA certificates and generate and provision device certificates?

Best regards,
Dejan

[srubin-ns]

Dejan, I have CONFIG_MQTT_HELPER_SEC_TAG set to the same tag number I used when provisioning the DigiCertGlobalRootG2.crt.pem into the modem with nrfcredstore.

As best as I can tell, I followed the guides exactly.

Can you recommend next steps for debugging?

Thank you

[dejans]

Hi,

You could try to check the following:

1. Does device ID match common name of the device certificate?

2. Is the root/intermediate certificate that signed the device certificate uploaded to DPS?

Best regards,
Dejan

[srubin-ns]

Thank you, Dejan. Here's what I have:

1. Does device ID match common name of the device certificate?

They match:

$ openssl x509 --noout --text --in ./certs/client-cert.pem

Certificate:

<SNIP>

Serial Number:

7e:92:f2:2a:d2:c2:0e:7e:2e:03:03:0a:b2:9e:27:96:7f:a3:c5:54

Signature Algorithm: ecdsa-with-SHA256

Issuer: C = US, ST = Test, L = Test, O = Test Organization, CN = Subordinate CA

Validity

Not Before: Mar 27 21:18:06 2025 GMT

Not After : Mar 27 21:18:06 2026 GMT

Subject: CN = 5034474b-3731-4ae0-8046-252272655e2e

<SNIP>

prj.conf:

<SNIP>

CONFIG_AZURE_IOT_HUB_DEVICE_ID="5034474b-3731-4ae0-8046-252272655e2e"

<SNIP>

2. Is the root/intermediate certificate that signed the device certificate uploaded to DPS?

Here is my Root CA certificate, which is uploaded to my DPS.

$ openssl x509 --noout --fingerprint -in ./ca/root-ca-cert.pem

SHA1 Fingerprint=46:17:FC:0B:20:58:4C:23:71:6E:80:7A:E6:A1:28:71:B7:B9:31:AC

I don't see the chained cert (client-cert-chain.pem) here. Should I?

Thanks

[Neso]

We've been unable to get your guide to work on other boards than the nrRF9161 DK. Seems to be a bug in how certificates are provisioned. Could you try with Thingy91 just to confirm it works?