Do nRF Cloud Credentials Expire ?

[Bastien42]

Hello,

I am currently using nRF Cloud to perform FOTA updates on my nRF9160 devices. I have multiple certificates on this device.

1. TLS certificate for my application which uses MQTT (does expire)

2. nRF Cloud credentials/certificate

Do nRF Cloud credentials expire ? If that is the case how should I update the credentials of a fleet of devices ?

Best regards

Bastien 

[Benjamin]

Hi Bastien,

When creating credentials with create_ca_cert, the default expiration time is 10 years. You can change this by using the --dv option and specify number of days valid.

You can re-provision devices to update credentials using the Provisioning Service.

Regards,
Benjamin

[Bastien42]

Hi Benjamin,

What limits the expiration time ? Can I just increase it enough and never change it afterward, and would that be less "secure" ?

If I am not mistaken, the Provisioning Service is only available for the nRF9161 and not the nRF9160. Would you recommend to use the nRF9161 instead ?

[Benjamin]

Yes, you are correct. The Provisioning Service is not available on the nRF9160. You can check out Modem key management on how to write/update credentials to the modem.

The create_ca_cert script does not let you set an expiration date after year 9999 (which should be enough for most applications). Security wise, it is safer to have a shorter expiration time as it decreases the time window for key compromise.

[Bastien42]

Ok, thank you. 

But a credentials update using modem key management could not be done for a fleet of devices simultaneously right ? (Or at least it seems troublesome since all devices have different credentials).

[Benjamin]

Hi Bastien,
There is indeed no easy solution to do it.  Every device need to have separate signing ceremony. Other than manually using a serial cable to upload new certificates, you could create a custom solution using FOTA. How many devices do you have?

The nRF91x1 series of devices would be preferable in this scenario since it supports the Provisioning Service.

Regards,
Benjamin