nRF54L15 - unable to provision key

RE: nRF54L15 - unable to provision key

SimonV — Mon, 15 Dec 2025 14:32:04 GMT

on SDK version 3.2.0 provisioning now works however you need to provision it with west ncs-provision upload -k key.pem --keyname BL_PUBKEY

RE: nRF54L15 - unable to provision key

AHaug — Fri, 13 Jun 2025 03:31:22 GMT

[quote user="igor.gorjanc"]

In my previous post you can see:

get version
manual upgrade
get version

[/quote]

Yes, i see that.

[quote user="igor.gorjanc"]Here is the version of the current nrfutil device. I have no idea what was the version before. The only thing that I can tell you is that, according to my logs, it was installed between 10th and 20th March this year.[/quote]

Noted. Well, since the issue was w.r.t nrfutil device, the only thing that's remaining here for now as I see it is updating the compatability matrices. I'll discuss with the nrfutil devs if nrfutil --version should also list subcomponents to avoid issues like this in the future.

Kind regards,
Andreas

RE: nRF54L15 - unable to provision key

Igor — Thu, 12 Jun 2025 11:52:09 GMT

In my previous post you can see:

get version
manual upgrade
get version

I don't see the difference in nrfutil versions. But you can see that nrfutil-device-x86_64-pc-windows-msvc-2.11.2 and nrfutil-suit-x86_64-pc-windows-msvc-0.9.0 was downloaded.
I don't know why versions of all installed components are not displayed.

Here is the version of the current nrfutil device. I have no idea what was the version before. The only thing that I can tell you is that, according to my logs, it was installed between 10th and 20th March this year.

PS H:\cup\build_1> nrfutil device --version
nrfutil-device 2.11.2 (481d897 2025-05-26)
commit-hash: 481d897514d9cdb5b565c726e709cca667a0985c
commit-date: 2025-05-26
host: x86_64-pc-windows-msvc
build-timestamp: 2025-05-26T11:20:01.692223900Z
classification: nrf-external

Detected SEGGER J-Link version: JLink_V8.40

The device command version you are currently using was tested with a different J-Link version (JLink_V8.18) than the one you have installed (JLink_V8.40). The tested version is not required, and your J-Link version will most likely work fine. If you get issues related to J-Link with your devices, use the tested version.

RE: nRF54L15 - unable to provision key

AHaug — Thu, 12 Jun 2025 03:36:37 GMT

Hello,

Maybe the SoC version vs SDK was a red herring and the issue was nrfutil device version (tool used by nrfutil for programming). I see in L29 in the terminal window attached that nrfutil-device is uppgraded to v2.11.2, meaning that you might've had a nrfutil device version that were too old.

I don't assume that you do, but do you know the version you previously had? sbarnowski do you know which version of nrfutil device you're running that does not work for NCS v3.0.0 but did work for NCS 2.9.1 (check with 'nrfutil device --version')?

Nonetheless I will add a comment w.r.t to the internal ticket.

Kind regards,
Andreas

RE: nRF54L15 - unable to provision key

Igor — Wed, 11 Jun 2025 10:38:31 GMT

Now I got a new DK ver 0.9.3 (not even mentioned in compatibility matrix). It has SoC QFAAC0 (also missing in compatibility matrix).
However, it still doesn't work with NCS 3.0.1. I tried also with NCS 3.0.2 (also not mentioned in compatibility matrix) but I get the same result.
After manual nrfutil upgrade it seems to work, despite the fact that the nrfutil version seems to be the same.

AHaug Please:
- update compatibility matrix with the mentioned DK, SoC and NCS versions
- clarify documentation regarding nrfutil version

PS H:\cup> imgtool keygen -t ed25519 -k private_key3.pem

PS H:\cup> nrfjprog --recover
Recovering device. This operation might take 30s.
Erasing user code and UICR flash areas.

PS H:\cup> west ncs-provision upload -s nrf54l15 -k private_key.pem 
nrfutil device x-provision-keys --key-file [redacted]\Temp\nrfutil_mu8r74uh\keyfile.json --traits jlink
Error: One or more key provisioning tasks failed:
 * 1057783423: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)

Uploading failed!

PS H:\cup> nrfutil device x-provision-keys --key-file [redacted]\Temp\nrfutil_mu8r74uh\keyfile.json --traits jlink --log-level trace --log-output stdout --json > log.txt
Error: One or more key provisioning tasks failed:
 * 1057783423: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)

PS H:\cup> nrfutil --version                                                                                                                                           
nrfutil 7.13.0 (8289424 2024-07-01)
commit-hash: 82894242d19ff24a1541712312b3ea3af0ca8f85
commit-date: 2024-07-01
host: x86_64-pc-windows-msvc
build-timestamp: 2024-07-01T07:37:50.864803700Z
classification: nrf-external

PS H:\cup> nrfutil upgrade  
Downloading nrfutil-device-x86_64-pc-windows-msvc-2.11.2
Verifying nrfutil-device-x86_64-pc-windows-msvc-2.11.2
Updating nrfutil-device to 2.11.2
nrfutil-nrf5sdk-tools is already the newest version (1.1.0)
Downloading nrfutil-suit-x86_64-pc-windows-msvc-0.9.0
Verifying nrfutil-suit-x86_64-pc-windows-msvc-0.9.0
Updating nrfutil-suit to 0.9.0
nrfutil-toolchain-manager is already the newest version (0.15.0)
[00:00:04] ###### 100% [Upgrade packages] Upgrade packages       

PS H:\cup> nrfutil --version
nrfutil 7.13.0 (8289424 2024-07-01)
commit-hash: 82894242d19ff24a1541712312b3ea3af0ca8f85
commit-date: 2024-07-01
host: x86_64-pc-windows-msvc
build-timestamp: 2024-07-01T07:37:50.864803700Z
classification: nrf-external

PS H:\cup> west ncs-provision upload -s nrf54l15 -k private_key.pem
nrfutil device x-provision-keys --key-file [redacted]\Temp\nrfutil_w7l429m0\keyfile.json --traits jlink
Uploaded

RE: nRF54L15 - unable to provision key

AHaug — Fri, 06 Jun 2025 11:20:56 GMT

I've added that to the tech doc ticket now,

Kind regards,
andreas

RE: nRF54L15 - unable to provision key

Igor — Fri, 06 Jun 2025 09:02:42 GMT

According to Developing with nRF54L Series there is also a nRF54L15 DK v0.9.3 but it is not even mentioned in compatibility matrix. Please fix also that.

RE: nRF54L15 - unable to provision key

AHaug — Fri, 06 Jun 2025 07:44:43 GMT

Hi,

[quote user="igor.gorjanc"] According to your link, this seems to be Engineering B and NOT supported in NCS 3.[/quote]

This is correct, Engineering B is not supported. Apologies for not suggesting this before and simply assuming you were using Rev 1... Again thank you Sebastian for bringing this up.

[quote user="igor.gorjanc"]This SoC is part of PCA10156 0.8.1 2024.41. I would like to point out that some other person from Nordic assured me it is compatible, but obviously isn't....[/quote]

Ah, I see where the fault has happened. There's a mismatch in https://docs.nordicsemi.com/bundle/ncs-3.0.0/page/nrf/app_dev/device_guides/nrf54l/index.html w.r.t the supported device.

This link comp matrix for DK and SDK states that 0.8.1 DK/PDK uses engineering B, i.e it's a PDK
This link Comp matrix for SoC version and SDK says that 0.8.1 is not usable after NCS v2.8.0
The documentation/guide for getting started with 54L15, i.e https://docs.nordicsemi.com/bundle/ncs-3.0.0/page/nrf/app_dev/device_guides/nrf54l/index.html states that you can use nRF54L15 PDK, which is a fault in the documentation. I believe you (as well as potentially other including myself) have been mislead by this..

[quote user="igor.gorjanc"]I downgraded to NCS 2.9.1 and it works. So it seems to be something related to NCS 3.0
SoC is N54L15 QFAABB 2433AA.[/quote]

The fact that it works for NCS v2.9.1 is interesting though... My best hypothesis is that rev 0.8.1 was not tested/tagged to be supported in NCS v2.9.1 (hence the lack of mentioning this device in the support matrix), but that the silicon on 0.8.1 and 0.9.1 are similar enough that it's still compatible (for atleast some things) in NSC v2.9.1

I will create a Tech doc ticket to review and update this immediately and verify if my reasoning based on the Datasheet docs (1. and 2.) overrules the development guide doc (3.)

Kind regards,
Andreas

RE: nRF54L15 - unable to provision key

sbarnowski — Thu, 05 Jun 2025 14:51:37 GMT

I am also on ENGB silicon. Trying to do this on NCS v3.0.2.

RE: nRF54L15 - unable to provision key

Igor — Thu, 05 Jun 2025 14:11:42 GMT

I downgraded to NCS 2.9.1 and it works. So it seems to be something related to NCS 3.0
SoC is N54L15 QFAABB 2433AA. According to your link, this seems to be Engineering B and NOT supported in NCS 3.
This SoC is part of PCA10156 0.8.1 2024.41. I would like to point out that some other person from Nordic assured me it is compatible, but obviously isn't....

RE: nRF54L15 - unable to provision key

AHaug — Thu, 05 Jun 2025 13:55:37 GMT

Hi,

That's a good suggestion. Could both you and Igor verify if the SoC you're using matches the support matrices for NCS v3.0.1?

https://docs.nordicsemi.com/bundle/comp_matrix_nrf54l15/page/COMP/nrf54l15/nrf54l15_ic_revision_overview.html for SoC revisions and variants and https://docs.nordicsemi.com/bundle/comp_matrix_nrf54l15/page/COMP/nrf54l15/nrf54l15_nrf_connect_sdk.html for which version of the SDK that requires what version of the SoC

Kind regards,
Andreas

RE: nRF54L15 - unable to provision key

sbarnowski — Thu, 05 Jun 2025 13:52:16 GMT

I am having the same issue. Could it be related to silicon version?

RE: nRF54L15 - unable to provision key

AHaug — Tue, 27 May 2025 09:21:59 GMT

Interesting.. And you see the same with nrfutil device erase --all as you previously used?

Are you able to get more verbose logging to see where nrfutil fails?

I.e nrfutil --verbose

Kind regards,
Andreas

RE: nRF54L15 - unable to provision key

Igor — Mon, 26 May 2025 08:22:29 GMT

Following the same steps as you I get an error.
Any idea how to fix this?

RE: nRF54L15 - unable to provision key

AHaug — Wed, 21 May 2025 13:22:38 GMT

Hi again,

I'm struggling with recreating this from my end i.e it does not fail here.

I'm sorry to ask you once more, but could you retrace this from the start and following the details in details.

If it does not work, I suspect there might be an issue with the OS used and I'll file a

Kind regards,
Andreas

RE: nRF54L15 - unable to provision key

Igor — Fri, 16 May 2025 10:20:50 GMT

I still get the same error.

PS H:\cup> nrfutil device erase --all                                                                                          
v Erased 1057746146
PS H:\cup> openssl genpkey -algorithm Ed25519 -out private_key.pem                                           
PS H:\cup> openssl pkey -in private_key.pem -pubout -out public_key.pem
PS H:\cup> python H:\ncs\v3.0.1\nrf\scripts\generate_psa_key_attributes.py --usage VERIFY_MESSAGE_EXPORT --id 0x40022100 --type ECC_TWISTED_EDWARDS --size 255 --algorithm EDDSA_PURE --location LOCATION_CRACEN --key-from-file public_key.pem  --file keys.json --cracen_usage RAW --lifetime PERSISTENCE_DEFAULT
PS H:\cup> nrfutil device x-provision-keys --serial-number 1057746146 --key-file keys.json    
x Failed to provision keys on 1057746146, [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)

RE: nRF54L15 - unable to provision key

AHaug — Fri, 16 May 2025 08:42:58 GMT

Fair enough, you also mentioned that you used the erase in VS Code as well.

Could you go through the steps you used to generate the JSON-key-file in the last step "nrfutil device x-provision-keys --serial-number <snr> --key-file <JSON-key-file>" just so we have the same foundation for recreating if the docs works or not?

Kind regards,
Andreas

RE: nRF54L15 - unable to provision key

Igor — Fri, 16 May 2025 08:12:06 GMT

Erase does not help.

PS H:\cup> python H:\ncs\v3.0.1\bootloader/mcuboot/scripts/imgtool.py keygen -t ed25519 -k private_key.pem
PS H:\cup> nrfutil device erase --all
v Erased 1057746146
PS H:\cup> west ncs-provision upload -s nrf54l15 -k private_key.pem
nrfutil device x-provision-keys --key-file [redacted]\Temp\nrfutil_2twnst4d\keyfile.json --traits jlink
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)


Uploading failed!

RE: nRF54L15 - unable to provision key

AHaug — Fri, 16 May 2025 08:05:58 GMT

Hello,

Looks like you're missing a command in https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf54l/kmu_provision.html, i.e the erase command in between generating the key and uploading the key

Let me know if this changes anything.

Kind regards,
Andreas