Hello, Nordic Team,
I am writing to request assistance with a Mater commissioning issue we are facing.
We are in the process of preparing out product for Matter certification and are currently testing the commissioning process using our own custom-generated PAA, PAI, and DAC certificates. However, the commissioning process is failing.
We are in the process of preparing out product for Matter certification and are currently testing the commissioning process using our own custom-generated PAA, PAI, and DAC certificates. However, the commissioning process is failing.
I suspect the issue might be related to the certificate chain validation. even though my local validation steps seem to pass. Could you please review my procedure to see if there are any protential errors?
0143.chip-error.txt
I noticed that failed with:
I noticed that failed with:
[1755248211.804] [22:24] [DMG] [1755248211.804] [22:24] [DMG] InteractionModelRevision = 12 [1755248211.804] [22:24] [DMG] }, [1755248211.804] [22:24] [DMG] Received Command Response Data, Endpoint=0 Cluster=0x0000_003E Command=0x0000_0001 [1755248211.804] [22:24] [CTL] Received Attestation Information from the device [1755248211.804] [22:24] [CTL] Successfully finished commissioning step 'SendAttestationRequest' [1755248211.804] [22:24] [CTL] AutoCommissioner setting attestationElements buffer size 585/585 [1755248211.804] [22:24] [CTL] Commissioning stage next step: 'SendAttestationRequest' -> 'AttestationVerification' [1755248211.804] [22:24] [CTL] Performing next commissioning step 'AttestationVerification' [1755248211.804] [22:24] [CTL] Verifying attestation [1755248211.817] [22:24] [CTL] Error on commissioning step 'AttestationVerification': 'src/controller/CHIPDeviceController.cpp:1283: CHIP Error 0x000000AC: Internal error' [1755248211.817] [22:24] [CTL] Failed verifying attestation information. Now checking DAC chain revoked status. [1755248211.817] [22:24] [CTL] Commissioning stage next step: 'AttestationVerification' -> 'AttestationRevocationCheck' [1755248211.817] [22:24] [CTL] Performing next commissioning step 'AttestationRevocationCheck' with completion status = 'src/controller/CHIPDeviceController.cpp:1283: CHIP Error 0x000000AC: Internal error' [1755248211.817] [22:24] [CTL] Verifying device's DAC chain revocation status [1755248211.817] [22:24] [CTL] Failed in verifying 'Attestation Information' command received from the device: err 500. Look at AttestationVerificationResult enum to understand the errors [1755248211.817] [22:24] [CTL] Error on commissioning step 'AttestationRevocationCheck': 'src/controller/CHIPDeviceController.cpp:1332: CHIP Error 0x000000AC: Internal error' [1755248211.817] [22:24] [CTL] Going from commissioning step 'AttestationRevocationCheck' with lastErr = 'src/controller/CHIPDeviceController.cpp:1332: CHIP Error 0x000000AC: Internal error' -> 'Cleanup' [1755248211.818] [22:24] [CTL] Performing next commissioning step 'Cleanup' with completion status = 'src/controller/CHIPDeviceController.cpp:1332: CHIP Error 0x000000AC: Internal error' [1755248211.818] [22:24] [CTL] Disarming failsafe on device 0xffff9c00b7d0 [1755248211.818] [22:24] [DMG] ICR moving to [AddingComm] [1755248211.818] [22:24] [DMG] ICR moving to [AddedComma]
I generated the PAA, PAI, and DAC certificates using the following chip-cert commands:
champon@NC:~/ncs/v3.0.2/modules/lib/matter/out/host$ ./chip-cert gen-att-cert --type a --subject-cn "ChampOn PAA CN" --subject-vid 0x143D \
--valid-from "2021-06-28 14:23:43" --lifetime 4294967295 \
--out-key ~/MatterTH/paa/ChampOn-Chip-PAA-Key.pem \
--out ~/MatterTH/paa/ChampOn-Chip-PAA-Cert.pem
champon@NC:~/ncs/v3.0.2/modules/lib/matter/out/host$ ./chip-cert gen-att-cert --type i --subject-cn "ChampOn PAI CN" --subject-vid 0x143D --valid-from "2021-06-28 14:23:43" --lifetime 4294967295 --ca-key ~/MatterTH/paa/ChampOn-Chip-PAA-Key.pem --ca-cert ~/MatterTH/paa/ChampOn-Chip-PAA-Cert.pem --out-key ~/MatterTH/paa/ChampOn-Chip-PAI-Key.pem --out ~/MatterTH/paa/ChampOn-Chip-PAI-Cert.pem
champon@NC:~/ncs/v3.0.2/modules/lib/matter/out/host$ ./chip-cert gen-att-cert --type d --subject-cn "ChampOn DAC 01" --subject-vid 0x143D --subject-pid 0x3001 --valid-from "2021-06-28 14:23:43" --lifetime 7305 --ca-key ~/MatterTH/paa/ChampOn-Chip-PAI-Key.pem --ca-cert ~/MatterTH/paa/ChampOn-Chip-PAI-Cert.pem --out-key ~/MatterTH/paa/ChampOn-Chip-DAC-Key.pem --out ~/MatterTH/paa/ChampOn-Chip-DAC-Cert.pem
I also convert the file format from pem to der use the following commands:
champon@NC:~/MatterTH/paa$ openssl x509 -in ~/MatterTH/paa/ChampOn-Chip-PAA-Cert.pem -outform DER -out ~/MatterTH/paa/ChampOn-Chip-PAA-Cert.der champon@NC:~/MatterTH/paa$ openssl x509 -in ~/MatterTH/paa/ChampOn-Chip-PAI-Cert.pem -outform DER -out ~/MatterTH/paa/ChampOn-Chip-PAI-Cert.der champon@NC:~/MatterTH/paa$ openssl x509 -in ~/MatterTH/paa/ChampOn-Chip-DAC-Cert.pem -outform DER -out ~/MatterTH/paa/ChampOn-Chip-DAC-Cert.der champon@NC:~/MatterTH/paa$ openssl ec -in ~/MatterTH/paa/ChampOn-Chip-DAC-Key.pem -outform DER -out ~/MatterTH/paa/ChampOn-Chip-DAC-Key.der read EC key writing EC key champon@NC:~/MatterTH/paa$ ls ChampOn-Chip-DAC-Cert.der ChampOn-Chip-DAC-Key.der ChampOn-Chip-PAA-Cert.der ChampOn-Chip-PAA-Key.der ChampOn-Chip-PAI-Cert.der ChampOn-Chip-PAI-Key.pem ChampOn-Chip-DAC-Cert.pem ChampOn-Chip-DAC-Key.pem ChampOn-Chip-PAA-Cert.pem ChampOn-Chip-PAA-Key.pem ChampOn-Chip-PAI-Cert.pem
I validated the generated certificate chain, and the command completed successfully without errors:
champon@NC:~/ncs/v3.0.2/modules/lib/matter/out/host$ ./chip-cert validate-att-cert --dac ~/MatterTH/paa/ChampOn-Chip-DAC-Cert.pem --pai ~/MatterTH/paa/ChampOn-Chip-PAI-Cert.pem --paa ~/MatterTH/paa/ChampOn-Chip-PAA-Cert.pem champon@NC:~/ncs/v3.0.2/modules/lib/matter/out/host$ openssl verify -CAfile ~/MatterTH/paa/ChampOn-Chip-PAA-Cert.pem -untrusted ~/MatterTH/paa/ChampOn-Chip-PAI-Cert.pem ~/MatterTH/paa/ChampOn-Chip-DAC-Cert.pem /home/champon/MatterTH/paa/ChampOn-Chip-DAC-Cert.pem: OK
Next, I generated the factory data and programmed it to our nRF54L15-based device. I monitored the UART output during startup and saw no apparent errors.
champon@NC:~/ncs/v3.0.2/modules/lib/matter$ python scripts/tools/nrfconnect/generate_nrfconnect_chip_factory_data.py --sn 1145141919812 --vendor_id 0x143d --product_id 0x3001 --vendor_name "Onvis" --product_name "HS3" --date 2025-08-01 --hw_ver 1 --hw_ver_str prerelease --spake2_it 1000 --spake2_salt U1BBS0UyUCBLZXkgU2FsdA== --discriminator 1730 --passcode 88581739 --include_passcode --overwrite --dac_cert ~/MatterTH/paa/ChampOn-Chip-DAC-Cert.der --dac_key ~/MatterTH/paa/ChampOn-Chip-DAC-Key.der --pai_cert ~/MatterTH/paa/ChampOn-Chip-PAI-Cert.der --cd_type 1 --enable_key 00112233445566778899AABBCCDDEEFF --offset 0x172000 --size 0x1000 -o ~/MatterTH/FactoryData/1730_88581739 --generate_onboarding --schema "scripts/tools/nrfconnect/nrfconnect_factory_data.schema" [INFO] Generating SPAKE2+ Verifier... [WARNING] KEY password has not been provided. It means that DAC key is not encrypted. [INFO] Validating JSON with schema... [INFO] Validate OK
Using the python script to generate the factory data
champon@NC:~/ncs/v3.0.2/modules/lib/matter$ python scripts/tools/nrfconnect/generate_nrfconnect_chip_factory_data.py \ --sn 1145141919813 \ --vendor_id 0x143d \ --product_id 0x3001 \ --vendor_name "Onvis" \ --product_name "HS3" \ --date 2025-08-01 \ --hw_ver 1 \ --hw_ver_str prerelease \ --spake2_it 1000 \ --spake2_salt U1BBS0UyUCBLZXkgU2FsdA== \ --discriminator 1731 \ --passcode 17318858 \ --include_passcode \ --overwrite \ --dac_cert ~/MatterTH/paa/ChampOn-Chip-DAC-Cert.der \ --dac_key ~/MatterTH/paa/ChampOn-Chip-DAC-Key.der \ --pai_cert ~/MatterTH/paa/ChampOn-Chip-PAI-Cert.der \ --cd_type 1 \ --offset 0x172000 \ --size 0x1000 \ -o ~/MatterTH/FactoryData/1731_17318858/1731_17318858 \ --generate_onboarding \ --schema "scripts/tools/nrfconnect/nrfconnect_factory_data.schema" \ --enable_key 00112233445566778899AABBCCDDEEFF
Then, I download the factory data to the NRF54L15 by the following command:
Before using the chip-tool to pairing the device, I transfer the PAA file to the raspberrpi
And I move the PAA file to the /var/paa-root-certs
According to the TH test document and other artical, I map the path to docker, and using chip-tool in the docker to pairing the device.
champon@NC:~/MatterTH/FactoryData/1730_88581739$ nrfutil device program --firmware 1730_88581739.hex --options chip_erase_mode=ERASE_NONE [00:00:00] ###### 100% [1/1 69403378] Programmed
Before using the chip-tool to pairing the device, I transfer the PAA file to the raspberrpi
champon@NC:~/ncs/v3.0.2/modules/lib/matter$ scp ~/MatterTH/paa/ChampOn-Chip-PAA-Cert.* [email protected]:/tmp/ [email protected]'s password: ChampOn-Chip-PAA-Cert.der 100% 448 91.1KB/s 00:00 ChampOn-Chip-PAA-Cert.pem 100% 664 108.6KB/s 00:00 champon@NC:~/ncs/v3.0.2/modules/lib/matter$ ssh [email protected] "sudo cp /tmp/ChampOn-Chip-PAA-Cert.* /var/paa-root-certs/" [email protected]'s password: sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper sudo: a password is required
And I move the PAA file to the /var/paa-root-certs
ubuntu@ubuntu:~$ ls /var/paa-root-certs/ | grep "ChampOn" ChampOn-Chip-PAA-Cert.der ChampOn-Chip-PAA-Cert.pem ChampOn-Chip-PAA-Key.der ChampOn-Chip-PAA-Key.pem
According to the TH test document and other artical, I map the path to docker, and using chip-tool in the docker to pairing the device.
ubuntu@ubuntu:~/certification-tool$ ./backend/test_collections/matter/scripts/OTBR/otbr_start.sh ################################################################################ otbr_start.sh: Starting... ################################################################################ ******************************************************************************** otbr_start.sh: Removing 'otbr-chip' container ******************************************************************************** nrfconnect/otbr 9185bda 083c8472bc52 2 years ago 1.21GB otbr image nrfconnect/otbr:9185bda already installed ******************************************************************************** otbr_start.sh: Starting 'otbr-chip' container ******************************************************************************** [sudo] password for ubuntu: 071bc1cde4ed8bb2321e630d9f7f8eda2ff881240608d5529e5a01c9f603337c ******************************************************************************** otbr_start.sh: Waiting 10 seconds to give the the docker container enough time to start up... ******************************************************************************** ******************************************************************************** otbr_start.sh: Setting up Thread Network ******************************************************************************** Param: 'dataset init new'Done Param: 'dataset channel 25'Done Param: 'dataset panid 0x5b35'Done Param: 'dataset extpanid 5b35dead5b35beef'Done Param: 'dataset networkname 5b35'Done Param: 'dataset networkkey 00112233445566778899aabbccddeeff'Done Param: 'dataset commit active'Done Param: 'prefix add fd11:35::/64 pasor'Done Param: 'ifconfig up'Done Param: 'thread start'Done Param: 'netdata register'Done Param: 'dataset active -x'0e08000000000001000035060004001fffe00708fd73e2cb9793c0920410f20cc5c53745d578603d629135681d6d0c0402a0f7f8000300001901025b3502085b35dead5b35beef030435623335051000112233445566778899aabbccddeeff Done Simple Dataset: 000300001902085b35dead5b35beef051000112233445566778899aabbccddeeff01025b35 ******************************************************************************** otbr_start.sh: Restarting the Raspi avahi to have it in a clean state ******************************************************************************** ################################################################################ otbr_start.sh: Finishing... ################################################################################
ubuntu@ubuntu:~/certification-tool$ docker run -v /var/paa-root-certs:/paa_roots -v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket -v /home/ubuntu/certification-tool/backend/test_collections/matter/sdk_tests/sdk_checkout/python_testing:/root/python_testing -v $(pwd):/launch_dir --privileged --network host -it connectedhomeip/chip-cert-bins:0c90d7299f7ab70b325e8a7febd0f210ae629ce4
Despite these steps, the pairing process fails. Could you please let me know if you see any issues with my approach or if there's anything I might have misunderstood?
Thank you for your time and support.
We are using the NCS3.0.2 and NRF54L15 custom board.
We are using the NCS3.0.2 and NRF54L15 custom board.
Thanks!
Xiongwei.Wang
