Azure IoT Hub authentication with DPS

I am trying to get my nRF9151DK connected to Azure IoT Hub. I have used the Azure IoT Hub sample, with some modifications to use LTE instead of WiFi which does not seem supported by my board. The board seems to connect well to the LTE network.
Then I am trying to connect to Azure IoT Hub via DPS but I think I have a problem with my certificates. I have intially followed the tutorial proposed here: https://docs.nordicsemi.com/bundle/ncs-2.9.1/page/nrf/libraries/networking/azure_iot_hub.html#lib-azure-iot-hub, including the certificates part, but I had the error below (mqtt_helper, error -107).

I could not connect to Azure IoT Hub, no matter if I use CONFIG_AZURE_IOT_HUB_DPS activated or not. I have tried modifying my certificates, by using the tutorial proposed by Microsoft: https://learn.microsoft.com/en-us/azure/iot-hub/tutorial-x509-test-certs?tabs=windows

I have now a root certificate, a subordonate certificate and a device certificate, all uploaded to my certificate manager in the board at the following tags:

# 10: root certificate
# 11: subordinate certificate
# 12: client certificate for device
# 13: Root CA certificate: DigiCert Global Root G2
# 14: Root CA certificate: Baltimore CyberTrust Root Certificate
Regarding Azure, my device is currently registered in my IoT Hub with the authentication method "Certification authority". My subordinate certificate is loaded both in IoT Hub and in DPS (which is linked to my IoT Hub). I have created an enrollment group whose certificate is still the subordinate certificate. However, the MQTT helper error remains, I have tried to add various Kconfig options in the prj.conf file with no luck (some may be irrelevant).

My prj.conf file is currently:
# General configuration
CONFIG_REBOOT=y
CONFIG_ASSERT=y

# Logging configuration
CONFIG_LOG=y
CONFIG_LOG_MODE_DEFERRED=y
CONFIG_LOG_BUFFER_SIZE=10240
CONFIG_LOG_BACKEND_UART=y
CONFIG_UART_CONSOLE=y
CONFIG_AZURE_IOT_HUB_LOG_LEVEL_DBG=y

# Network configuration
CONFIG_NETWORKING=y
CONFIG_NET_NATIVE=y
CONFIG_NET_IPV4=y
CONFIG_NET_CONNECTION_MANAGER=y

# LTE configuration
CONFIG_NRF_MODEM_LIB=y
CONFIG_PDN=y
CONFIG_PDN_DEFAULTS_OVERRIDE=y
CONFIG_PDN_DEFAULT_APN="pse.telus.iot"
CONFIG_LTE_LINK_CONTROL=y
CONFIG_LTE_LINK_CONTROL_LOG_LEVEL_DBG=y
CONFIG_LTE_AUTO_INIT_AND_CONNECT=y

# Azure IoT Hub configuration
CONFIG_AZURE_IOT_HUB=y
CONFIG_AZURE_IOT_HUB_DEVICE_ID="XXXXX"
# Host name must be configured if DPS is not used
CONFIG_AZURE_IOT_HUB_HOSTNAME="XXXXX.azure-devices.net"
CONFIG_AZURE_IOT_HUB_USER_NAME_BUF_SIZE=512
CONFIG_AZURE_IOT_HUB_AUTO_DEVICE_TWIN_REQUEST=y
CONFIG_AZURE_IOT_HUB_TOPIC_MAX_LEN=512

# Azure IoT Hub DPS configuration
CONFIG_AZURE_IOT_HUB_DPS=y
CONFIG_AZURE_IOT_HUB_DPS_REG_ID="XXXXX-enrollment-group"
CONFIG_AZURE_IOT_HUB_DPS_ID_SCOPE="0neXXXXXXXX"
CONFIG_AZURE_IOT_HUB_DPS_TIMEOUT_SEC=60

# Azure IoT Hub certificates
# 10: root certificate
# 11: subordinate certificate
# 12: client certificate for device XXXXX
# 13: Root CA certificate: DigiCert Global Root G2
# 14: Root CA certificate: Baltimore CyberTrust Root Certificate
CONFIG_MQTT_HELPER_SEC_TAG=12
CONFIG_MQTT_HELPER_SECONDARY_SEC_TAG=13

# MQTT configuration
CONFIG_MQTT_LIB=y
CONFIG_MQTT_LIB_TLS=y
CONFIG_MQTT_HELPER=y
CONFIG_MQTT_HELPER_NATIVE_TLS=y
CONFIG_MQTT_HELPER_PORT=8883
CONFIG_MQTT_HELPER_SEND_TIMEOUT=y
CONFIG_MQTT_HELPER_SEND_TIMEOUT_SEC=15
CONFIG_MQTT_KEEPALIVE=1767
CONFIG_MQTT_HELPER_STACK_SIZE=8192

# Hardware configuration
CONFIG_MODEM_JWT=y
CONFIG_HW_ID_LIBRARY_SOURCE_UUID=y

# Other dependencies
CONFIG_CJSON_LIB=y
CONFIG_FLASH=y
CONFIG_FLASH_MAP=y
CONFIG_FCB=y
CONFIG_TLS_CREDENTIALS=y
CONFIG_SETTINGS=y
CONFIG_SETTINGS_FCB=y
CONFIG_MPU_ALLOW_FLASH_WRITE=y

Am I missing something, maybe obvious?

Please let me know if you need any additional information.

My logs are currently:

*** Booting My Application v2.1.0-dev-12e5ee106034 ***
*** Using nRF Connect SDK v2.9.1-60d0d6c8d42d ***
*** Using Zephyr OS v3.7.99-ca954a6216c9 ***
I: Starting bootloader
I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Image index: 0, Swap type: none
I: Bootloader chainload address offset: 0x10000
*** Booting nRF Connect SDK v2.9.1-60d0d6c8d42d ***
*** Using Zephyr OS v3.7.99-ca954a6216c9 ***
[00:00:00.251,312] <inf> azure_iot_hub_sample: Azure IoT Hub sample started
[00:00:00.251,373] <inf> azure_iot_hub_sample: Bringing network interface up and connecting to the network
[00:00:00.513,366] <inf> nrf_modem_lib_trace: Trace thread ready
[00:00:00.521,331] <inf> nrf_modem_lib_trace: Trace level override: 2
[00:00:00.523,010] <dbg> lte_lc: xsystemmode_mode_set: System mode set to 7, preference 3
[00:00:00.587,310] <dbg> lte_lc: cfun_mode_set: Functional mode set to 21
[00:00:00.587,799] <inf> azure_iot_hub_sample: Device ID: XXXXX
+CGEV: EXCE STATUS 0
%MDMEV: SEARCH STATUS 1
[00:00:03.189,819] <dbg> lte_lc: at_handler_mdmev: %MDMEV notification
[00:00:03.189,880] <dbg> lte_lc: mdmev_parse: Occurrence found: SEARCH STATUS 1

[00:00:03.189,880] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=11
[00:00:03.189,910] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:03.189,910] <dbg> lte_lc: event_handler_list_dispatch: Done
+CEREG: 2,"2D86","0335CB0A",7
[00:00:03.566,772] <dbg> lte_lc: at_handler_cereg: +CEREG notification: +CEREG: 2,"2D86","0335CB0A",7
[00:00:03.566,864] <dbg> lte_lc: parse_cereg: Network registration status: 2
[00:00:03.567,016] <dbg> lte_lc: parse_cereg: LTE mode: 7
[00:00:03.567,077] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=0
[00:00:03.567,108] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:03.567,108] <dbg> lte_lc: event_handler_list_dispatch: Done
[00:00:03.567,138] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=4
[00:00:03.567,169] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:03.567,169] <dbg> lte_lc: event_handler_list_dispatch: Done
[00:00:03.567,199] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=5
[00:00:03.567,230] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:03.567,230] <dbg> lte_lc: event_handler_list_dispatch: Done
%MDMEV: PRACH CE-LEVEL 0
[00:00:04.260,070] <dbg> lte_lc: at_handler_mdmev: %MDMEV notification
[00:00:04.260,131] <dbg> lte_lc: mdmev_parse: Occurrence found: PRACH CE-LEVEL 0

[00:00:04.260,162] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=11
[00:00:04.260,162] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:04.260,192] <dbg> lte_lc: event_handler_list_dispatch: Done
+CSCON: 1
[00:00:04.418,090] <dbg> lte_lc: at_handler_cscon: +CSCON notification
[00:00:04.418,151] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=3
[00:00:04.418,182] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:04.418,243] <dbg> lte_lc: event_handler_list_dispatch: Done
+CGEV: ME PDN ACT 0,0
+CNEC_ESM: 50,0
%MDMEV: SEARCH STATUS 2
[00:00:06.737,792] <dbg> lte_lc: at_handler_mdmev: %MDMEV notification
[00:00:06.737,823] <dbg> lte_lc: mdmev_parse: Occurrence found: SEARCH STATUS 2

[00:00:06.737,854] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=11
[00:00:06.737,854] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:06.737,884] <dbg> lte_lc: event_handler_list_dispatch: Done
+CEREG: 1,"2D86","0335CB0A",7,,,"11100000","11100000"
[00:00:06.738,037] <dbg> lte_lc: at_handler_cereg: +CEREG notification: +CEREG: 1,"2D86","0335CB0A",7,,,"11100000","11100000"
[00:00:06.738,128] <dbg> lte_lc: parse_cereg: Network registration status: 1
[00:00:06.738,342] <dbg> lte_lc: parse_cereg: LTE mode: 7
[00:00:06.738,403] <dbg> lte_lc: event_handler_list_dispatch: Dispatching event: type=0
[00:00:06.738,433] <dbg> lte_lc: event_handler_list_dispatch: - handler=0x000191A5
[00:00:06.738,525] <dbg> lte_lc: event_handler_list_dispatch: Done
[00:00:06.738,952] <inf> azure_iot_hub_sample: Network connectivity established and IP address assigned
[00:00:06.739,044] <inf> azure_iot_hub_sample: Connected to network
[00:00:06.739,074] <inf> azure_iot_hub_sample: Starting DPS
[00:00:06.739,135] <dbg> azure_iot_hub_dps: dps_reg_id_set: No registration ID provided, using ID from Kconfig: XXXXX-enrollment-group
[00:00:06.739,166] <dbg> azure_iot_hub_dps: dps_reg_id_set: Setting DPS registration ID: nrf-enrollment-group
[00:00:06.739,227] <dbg> azure_iot_hub_dps: dps_id_scope_set: No ID scope provided, using ID scope from Kconfig: 0neXXXXXXXX
[00:00:06.739,257] <dbg> azure_iot_hub_dps: dps_id_scope_set: Setting DPS ID scope: 0neXXXXXXXX
[00:00:06.739,501] <dbg> azure_iot_hub_dps: dps_on_settings_loaded: Settings fully loaded
[00:00:06.739,562] <dbg> azure_iot_hub_dps: dps_state_set: State transition: DPS_STATE_UNINIT --> DPS_STATE_DISCONNECTED
[00:00:06.739,593] <inf> azure_iot_hub_sample: DPS registration status: AZURE_IOT_HUB_DPS_REG_STATUS_NOT_STARTED
[00:00:06.739,654] <dbg> azure_iot_hub_dps: provisioning_client_init: Client ID (size: 20): XXXXX-enrollment-group
[00:00:06.739,746] <dbg> azure_iot_hub_dps: provisioning_client_init: User name (size: 69): 0neXXXXXXXX/registrations/XXXXX-enrollment-group/api-version=2019-03-31
[00:00:06.914,703] <err> mqtt_helper: mqtt_connect, error: -107
[00:00:06.914,733] <err> azure_iot_hub_dps: mqtt_helper_connect failed, error: -107
[00:00:06.914,764] <err> azure_iot_hub_sample: DPS failed to start, error: -107
[00:00:06.914,764] <err> azure_iot_hub_sample: Failed to run DPS, error: -107, terminating connection attempt

Parents
  • According to step 7 of the instructions, the device certificate and the subordinate CA certificate chain should be combined into a single file and provisioned into the security tag in CONFIG_MQTT_HELPER_SEC_TAG. But it looks like the client and subordinate are stored in two different security tags.

    Could you run through the instructions step by step, and then see what the output of nrfcredstore <serial port> list is? You should only need to use two of them.

    Mariano

Reply
  • According to step 7 of the instructions, the device certificate and the subordinate CA certificate chain should be combined into a single file and provisioned into the security tag in CONFIG_MQTT_HELPER_SEC_TAG. But it looks like the client and subordinate are stored in two different security tags.

    Could you run through the instructions step by step, and then see what the output of nrfcredstore <serial port> list is? You should only need to use two of them.

    Mariano

Children
  • Sorry I forgot to mention it but I had noticed this issue too and already corrected it, but the error remains the same (with or without DPS, with or without CONFIG_MQTT_HELPER_PROVISION_CERTIFICATES).

    Here are the current certificates:

    # 10: root certificate
    # 11: subordinate certificate (root)
    # 13: Root CA certificate: DigiCert Global Root G2
    # 14: Root CA certificate: Baltimore CyberTrust Root Certificate
    # 11/13/14: client certificates for device XXXXX

    Command "nrfcredstore COM6 list" returns:
    Secure tag - Key type - SHA
    10 ROOT_CA_CERT C6871D...
    11 ROOT_CA_CERT 60A9DB...
    11 CLIENT_CERT D96C03...
    13 ROOT_CA_CERT 0E0A61...
    13 CLIENT_CERT D96C03...
    14 ROOT_CA_CERT 44866C...
    14 CLIENT_CERT D96C03...
    16842753 ROOT_CA_CERT 2C4395...
    16842753 CLIENT_CERT 276934...
    16842753 CLIENT_KEY 091305...
    4294967292 NORDIC_PUB_KEY 672E2F...
    4294967293 NORDIC_ID_ROOT_CA 2C4395...
    4294967294 DEV_ID_PUB_KEY 4375EE...
  • I don't think the subordinate certificate needs to be loaded in a separate sec tag. It needs to be combined with the device certificate into a single file:

    cat certs/client-cert.pem ca/sub-ca-cert.pem > certs/client-cert-chain.pem

    And then the combined file uploaded as the client certificate

  • I added it under a new tag (15), changed the primary tag as 15 in prj.conf, but the error remains the same

Related