Do nRF Cloud Credentials Expire ?

RE: Do nRF Cloud Credentials Expire ?

Benjamin — Wed, 03 Dec 2025 12:23:03 GMT

Hi Bastien,
There is indeed no easy solution to do it. Every device need to have separate signing ceremony. Other than manually using a serial cable to upload new certificates, you could create a custom solution using FOTA. How many devices do you have?

The nRF91x1 series of devices would be preferable in this scenario since it supports the Provisioning Service.

Regards,
Benjamin

RE: Do nRF Cloud Credentials Expire ?

Bastien42 — Mon, 01 Dec 2025 15:05:25 GMT

Ok, thank you.

But a credentials update using modem key management could not be done for a fleet of devices simultaneously right ? (Or at least it seems troublesome since all devices have different credentials).

RE: Do nRF Cloud Credentials Expire ?

Benjamin — Mon, 01 Dec 2025 14:37:33 GMT

Yes, you are correct. The Provisioning Service is not available on the nRF9160. You can check out Modem key management on how to write/update credentials to the modem.

The create_ca_cert script does not let you set an expiration date after year 9999 (which should be enough for most applications). Security wise, it is safer to have a shorter expiration time as it decreases the time window for key compromise.

RE: Do nRF Cloud Credentials Expire ?

Bastien42 — Mon, 01 Dec 2025 07:55:57 GMT

Hi Benjamin,

What limits the expiration time ? Can I just increase it enough and never change it afterward, and would that be less "secure" ?

If I am not mistaken, the Provisioning Service is only available for the nRF9161 and not the nRF9160. Would you recommend to use the nRF9161 instead ?

RE: Do nRF Cloud Credentials Expire ?

Benjamin — Tue, 25 Nov 2025 14:24:40 GMT

Hi Bastien,

When creating credentials with create_ca_cert, the default expiration time is 10 years. You can change this by using the --dv option and specify number of days valid.

You can re-provision devices to update credentials using the Provisioning Service.

Regards,
Benjamin