Azure IoT Hub authentication with DPS

I am trying to get my nRF9151DK connected to Azure IoT Hub. I have used the Azure IoT Hub sample, with some modifications to use LTE instead of WiFi which does not seem supported by my board. The board seems to connect well to the LTE network.
Then I am trying to connect to Azure IoT Hub via DPS but I think I have a problem with my certificates. I have intially followed the tutorial proposed here: https://docs.nordicsemi.com/bundle/ncs-2.9.1/page/nrf/libraries/networking/azure_iot_hub.html#lib-azure-iot-hub, including the certificates part, but I had the error below (mqtt_helper, error -107).

I could not connect to Azure IoT Hub, no matter if I use CONFIG_AZURE_IOT_HUB_DPS activated or not. I have tried modifying my certificates, by using the tutorial proposed by Microsoft: https://learn.microsoft.com/en-us/azure/iot-hub/tutorial-x509-test-certs?tabs=windows

I have now a root certificate, a subordonate certificate and a device certificate, all uploaded to my certificate manager in the board at the following tags:

# 10: root certificate
# 11: subordinate certificate
# 12: client certificate for device
# 13: Root CA certificate: DigiCert Global Root G2
# 14: Root CA certificate: Baltimore CyberTrust Root Certificate
Regarding Azure, my device is currently registered in my IoT Hub with the authentication method "Certification authority". My subordinate certificate is loaded both in IoT Hub and in DPS (which is linked to my IoT Hub). I have created an enrollment group whose certificate is still the subordinate certificate. However, the MQTT helper error remains, I have tried to add various Kconfig options in the prj.conf file with no luck (some may be irrelevant).

My prj.conf file is currently:
# General configuration
CONFIG_REBOOT=y
CONFIG_ASSERT=y

# Logging configuration
CONFIG_LOG=y
CONFIG_LOG_MODE_DEFERRED=y
CONFIG_LOG_BUFFER_SIZE=10240
CONFIG_LOG_BACKEND_UART=y
CONFIG_UART_CONSOLE=y
CONFIG_AZURE_IOT_HUB_LOG_LEVEL_DBG=y

# Network configuration
CONFIG_NETWORKING=y
CONFIG_NET_NATIVE=y
CONFIG_NET_IPV4=y
CONFIG_NET_CONNECTION_MANAGER=y

# LTE configuration
CONFIG_NRF_MODEM_LIB=y
CONFIG_PDN=y
CONFIG_PDN_DEFAULTS_OVERRIDE=y
CONFIG_PDN_DEFAULT_APN="pse.telus.iot"
CONFIG_LTE_LINK_CONTROL=y
CONFIG_LTE_LINK_CONTROL_LOG_LEVEL_DBG=y
CONFIG_LTE_AUTO_INIT_AND_CONNECT=y

# Azure IoT Hub configuration
CONFIG_AZURE_IOT_HUB=y
CONFIG_AZURE_IOT_HUB_DEVICE_ID="XXXXX"
# Host name must be configured if DPS is not used
CONFIG_AZURE_IOT_HUB_HOSTNAME="XXXXX.azure-devices.net"
CONFIG_AZURE_IOT_HUB_USER_NAME_BUF_SIZE=512
CONFIG_AZURE_IOT_HUB_AUTO_DEVICE_TWIN_REQUEST=y
CONFIG_AZURE_IOT_HUB_TOPIC_MAX_LEN=512

# Azure IoT Hub DPS configuration
CONFIG_AZURE_IOT_HUB_DPS=y
CONFIG_AZURE_IOT_HUB_DPS_REG_ID="XXXXX-enrollment-group"
CONFIG_AZURE_IOT_HUB_DPS_ID_SCOPE="0neXXXXXXXX"
CONFIG_AZURE_IOT_HUB_DPS_TIMEOUT_SEC=60

# Azure IoT Hub certificates
# 10: root certificate
# 11: subordinate certificate
# 12: client certificate for device XXXXX
# 13: Root CA certificate: DigiCert Global Root G2
# 14: Root CA certificate: Baltimore CyberTrust Root Certificate
CONFIG_MQTT_HELPER_SEC_TAG=12
CONFIG_MQTT_HELPER_SECONDARY_SEC_TAG=13

# MQTT configuration
CONFIG_MQTT_LIB=y
CONFIG_MQTT_LIB_TLS=y
CONFIG_MQTT_HELPER=y
CONFIG_MQTT_HELPER_NATIVE_TLS=y
CONFIG_MQTT_HELPER_PORT=8883
CONFIG_MQTT_HELPER_SEND_TIMEOUT=y
CONFIG_MQTT_HELPER_SEND_TIMEOUT_SEC=15
CONFIG_MQTT_KEEPALIVE=1767
CONFIG_MQTT_HELPER_STACK_SIZE=8192

# Hardware configuration
CONFIG_MODEM_JWT=y
CONFIG_HW_ID_LIBRARY_SOURCE_UUID=y

# Other dependencies
CONFIG_CJSON_LIB=y
CONFIG_FLASH=y
CONFIG_FLASH_MAP=y
CONFIG_FCB=y
CONFIG_TLS_CREDENTIALS=y
CONFIG_SETTINGS=y
CONFIG_SETTINGS_FCB=y
CONFIG_MPU_ALLOW_FLASH_WRITE=y

Am I missing something, maybe obvious?

Please let me know if you need any additional information.

My logs are currently:

*** Booting My Application v2.1.0-dev-12e5ee106034 ***
*** Using nRF Connect SDK v2.9.1-60d0d6c8d42d ***
*** Using Zephyr OS v3.7.99-ca954a6216c9 ***
I: Starting bootloader
I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Image index: 0, Swap type: none
I: Bootloader chainload address offset: 0x10000
*** Booting nRF Connect SDK v2.9.1-60d0d6c8d42d ***
*** Using Zephyr OS v3.7.99-ca954a6216c9 ***
[00:00:00.251,312] <inf> azure_iot_hub_sample: Azure IoT Hub sample started
[00:00:00.251,373] <inf> azure_iot_hub_sample: Bringing network interface up and connecting to the network
[00:00:00.513,366] <inf> nrf_modem_lib_trace: Trace thread ready
[00:00:00.521,331] <inf> nrf_modem_lib_trace: Trace level override: 2
[00:00:00.523,010] <dbg> lte_lc: xsystemmode_mode_set: System mode set to 7, preference 3
[00:00:00.587,310] <dbg> lte_lc: cfun_mode_set: Functional mode set to 21
[00:00:00.587,799] <inf> azure_iot_hub_sample: Device ID: XXXXX
+CGEV: EXCE STATUS 0
%MDMEV: SEARCH STATUS 1
[00:00:03.189,819] <dbg> lte_lc: at_handler_mdmev: %MDMEV notification
[00:00:03.189,880] <dbg> lte_lc: mdmev_parse: Occurrence found: SEARCH STATUS 1

[00:00:03.189,880] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=11
[00:00:03.189,910] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:03.189,910] <dbg> lte_lc: event_handler_list_dispatch: Done
+CEREG: 2,"2D86","0335CB0A",7
[00:00:03.566,772] <dbg> lte_lc: at_handler_cereg: +CEREG notification: +CEREG: 2,"2D86","0335CB0A",7
[00:00:03.566,864] <dbg> lte_lc: parse_cereg: Network registration status: 2
[00:00:03.567,016] <dbg> lte_lc: parse_cereg: LTE mode: 7
[00:00:03.567,077] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=0
[00:00:03.567,108] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:03.567,108] <dbg> lte_lc: event_handler_list_dispatch: Done
[00:00:03.567,138] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=4
[00:00:03.567,169] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:03.567,169] <dbg> lte_lc: event_handler_list_dispatch: Done
[00:00:03.567,199] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=5
[00:00:03.567,230] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:03.567,230] <dbg> lte_lc: event_handler_list_dispatch: Done
%MDMEV: PRACH CE-LEVEL 0
[00:00:04.260,070] <dbg> lte_lc: at_handler_mdmev: %MDMEV notification
[00:00:04.260,131] <dbg> lte_lc: mdmev_parse: Occurrence found: PRACH CE-LEVEL 0

[00:00:04.260,162] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=11
[00:00:04.260,162] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:04.260,192] <dbg> lte_lc: event_handler_list_dispatch: Done
+CSCON: 1
[00:00:04.418,090] <dbg> lte_lc: at_handler_cscon: +CSCON notification
[00:00:04.418,151] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=3
[00:00:04.418,182] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:04.418,243] <dbg> lte_lc: event_handler_list_dispatch: Done
+CGEV: ME PDN ACT 0,0
+CNEC_ESM: 50,0
%MDMEV: SEARCH STATUS 2
[00:00:06.737,792] <dbg> lte_lc: at_handler_mdmev: %MDMEV notification
[00:00:06.737,823] <dbg> lte_lc: mdmev_parse: Occurrence found: SEARCH STATUS 2

[00:00:06.737,854] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=11
[00:00:06.737,854] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:06.737,884] <dbg> lte_lc: event_handler_list_dispatch: Done
+CEREG: 1,"2D86","0335CB0A",7,,,"11100000","11100000"
[00:00:06.738,037] <dbg> lte_lc: at_handler_cereg: +CEREG notification: +CEREG: 1,"2D86","0335CB0A",7,,,"11100000","11100000"
[00:00:06.738,128] <dbg> lte_lc: parse_cereg: Network registration status: 1
[00:00:06.738,342] <dbg> lte_lc: parse_cereg: LTE mode: 7
[00:00:06.738,403] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=0
[00:00:06.738,433] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:06.738,525] <dbg> lte_lc: event_handler_list_dispatch: Done
[00:00:06.738,952] <inf> azure_iot_hub_sample: Network connectivity established and IP address assigned
[00:00:06.739,044] <inf> azure_iot_hub_sample: Connected to network
[00:00:06.739,074] <inf> azure_iot_hub_sample: Starting DPS
[00:00:06.739,135] <dbg> azure_iot_hub_dps: dps_reg_id_set: No registration ID provided, using ID from Kconfig: XXXXX-enrollment-group
[00:00:06.739,166] <dbg> azure_iot_hub_dps: dps_reg_id_set: Setting DPS registration ID: nrf-enrollment-group
[00:00:06.739,227] <dbg> azure_iot_hub_dps: dps_id_scope_set: No ID scope provided, using ID scope from Kconfig: 0neXXXXXXXX
[00:00:06.739,257] <dbg> azure_iot_hub_dps: dps_id_scope_set: Setting DPS ID scope: 0neXXXXXXXX
[00:00:06.739,501] <dbg> azure_iot_hub_dps: dps_on_settings_loaded: Settings fully loaded
[00:00:06.739,562] <dbg> azure_iot_hub_dps: dps_state_set: State transition: DPS_STATE_UNINIT --> DPS_STATE_DISCONNECTED
[00:00:06.739,593] <inf> azure_iot_hub_sample: DPS registration status: AZURE_IOT_HUB_DPS_REG_STATUS_NOT_STARTED
[00:00:06.739,654] <dbg> azure_iot_hub_dps: provisioning_client_init: Client ID (size: 20): XXXXX-enrollment-group
[00:00:06.739,746] <dbg> azure_iot_hub_dps: provisioning_client_init: User name (size: 69): 0neXXXXXXXX/registrations/XXXXX-enrollment-group/api-version=2019-03-31
[00:00:06.914,703] <err> mqtt_helper: mqtt_connect, error: -107
[00:00:06.914,733] <err> azure_iot_hub_dps: mqtt_helper_connect failed, error: -107
[00:00:06.914,764] <err> azure_iot_hub_sample: DPS failed to start, error: -107
[00:00:06.914,764] <err> azure_iot_hub_sample: Failed to run DPS, error: -107, terminating connection attempt

  • I have tried to put my certificates on the same tag (add client certificate on tags 11, 13 & 14 then change CONFIG_MQTT_HELPER_SEC_TAG and CONFIG_MQTT_HELPER_SECONDARY_SEC_TAG accordingly), the error remains with using DPS. If I set CONFIG_AZURE_IOT_HUB_DPS=n, now the error is 

    [00:00:13.457,305] <inf> azure_iot_hub_sample: Azure IoT Hub library initialized
    [00:00:13.457,366] <dbg> azure_iot_hub: iot_hub_state_set: State transition: STATE_DISCONNECTED --> STATE_CONNECTING
    [00:00:13.457,397] <inf> azure_iot_hub_sample: AZURE_IOT_HUB_EVT_CONNECTING
    [00:00:13.457,397] <err> azure_iot_hub: Failed to get user name, az error: 0x80010002
    [00:00:13.457,458] <dbg> azure_iot_hub: iot_hub_state_set: State transition: STATE_CONNECTING --> STATE_DISCONNECTED
    [00:00:13.457,458] <err> azure_iot_hub_sample: azure_iot_hub_connect failed: -14

  • Hello,

    Which Modem FW are you on?

    I will check if we have some information on using DPS.

    Best regards,

    Michal

  • The version seems to be mfw_nrf91x1_2.0.2 (response to AT+CGMR). I don't mind not using DPS if simpler, but in both cases I am stuck right now.

Related