nRF Cloud CoAP connection fails with err -111 (self-signed CA certificate)

[mincom]

Hi,

I'm developing a custom board based on nRF9151 (similar to Thingy:91X) and trying to connect to nRF Cloud for location services (A-GNSS, Wi-Fi location, Cellular location).

## Environment

- nRF Connect SDK: v3.1.1

- Modem firmware: mfw_nrf91x1_2.0.4

- Board: Custom board with nRF9151 + nRF7002 (Wi-Fi) + GD25LE255E (external flash)

- nRF Cloud Plan: Developer (free)

## What I've done

1. **Claimed the device** using Attestation Token (`AT%ATTESTTOKEN`)

2. **Created Provisioning Rule** with:

- Client Private Key Generation (Succeeded)

- Certificate Signing Request (Succeeded)

- Server Certificate - AWS Root CA (Succeeded)

- Client Certificate - self-signed with my own CA (Succeeded)

3. **Installed certificates** to modem (security tag 16842753):

AT%CMNG=1,16842753 %CMNG: 16842753,0,"..." ← Server Certificate (AWS Root CA) %CMNG: 16842753,1,"..." ← Client Certificate (self-signed) %CMNG: 16842753,2,"..." ← Public Key

4. **Also tried security tag 16** (factory JITP), but it only has Public Key (Type 2), no Client Certificate.

## Problem

Connection to nRF Cloud CoAP always fails with error -111 (ECONNREFUSED):

transport: Connecting to nRF Cloud CoAP with client ID: 50433155-3335-4269-80e2-1a066ffdc628 nrf_cloud_coap_transport: Could not connect to nRF Cloud CoAP server coap.nrfcloud.com, port: 13334. err: -111

## Configuration (prj.conf)

CONFIG_NRF_CLOUD_CLIENT_ID_SRC_INTERNAL_UUID=y CONFIG_NRF_CLOUD_COAP_SEC_TAG=16842753

## Questions

1. **Is it possible to use a self-signed CA certificate with the Developer (free) plan?**

- Or do I need Pro/Enterprise plan to register my own CA?

2. **What is the correct provisioning workflow for custom boards (not Nordic DKs)?**

- Nordic DKs come with factory-provisioned certificates, but custom boards don't have them.

3. **Is there an alternative way to provision certificates for custom nRF9151 boards?**

Thank you for your help!

[mincom]

Update: Still getting -111 error after nRF Cloud auto-onboarding

I tried a different approach using the attestation token and "Create new rule for onboarding to nRF Cloud" option as described in the nRF9151 Connect Kit guide.

Steps I followed:

1. Flashed nrf_provisioning sample to custom board
2. Got attestation token using nrf_provisioning token command
3. In nRF Cloud UI: Claim Device → pasted attestation token → enabled "Create new rule for onboarding to nRF Cloud" → Create Rule and Claim Device
4. Rebooted device - provisioning completed successfully
5. nRF Cloud UI shows device status as READY with:
   • Cloud Access Key Generation: Succeeded
   • Server Certificate: Succeeded (Generated for nRF Cloud auto-onboarding)
   • Client Certificate: Succeeded (Generated for nRF Cloud auto-onboarding)

Verification:

AT%CMNG=1,16842753

%CMNG: 16842753,0,"F6EEF665B61C4F9852AC3C84747D0EE92D0E79B24C187ABB7CEEF7A85E173534"

%CMNG: 16842753,1,"E882E67370D8457A30341D0FC89E1E0E5D95F517263578A1DE547A459E0F1662"

%CMNG: 16842753,2,"79EB6167AACF3A9333FFA8CF9F15EC351AF898F637499264B94F4F77444D59A0"

Server CA (Type 0) content is identical to factory-provisioned Thingy:91 X (SEC_TAG 4242):

• Amazon Root CA 1
• nRF Cloud CoAP CA

But still getting -111 error:

nrf_cloud_coap_transport: Could not connect to nRF Cloud CoAP server coap.nrfcloud.com, port: 13334. err: -111

Additional observation:

• Factory Thingy:91 X with SEC_TAG=4242 → Works ✓
• Factory Thingy:91 X with SEC_TAG=16842753 (auto-onboarded) → Does NOT work ✗
• Custom board with SEC_TAG=16842753 (auto-onboarded) → Does NOT work ✗

It seems like the Client Certificate signed by nRF Cloud auto-onboarding is being rejected during TLS handshake, even though the Server CA is correct.

Questions:

1. Is there a difference between factory-provisioned certificates (SEC_TAG 4242) and auto-onboarded certificates (SEC_TAG 16842753)?
2. Is there any additional configuration needed for auto-onboarded devices to use CoAP?
3. How can I verify that the Client Certificate is correctly signed and trusted by nRF Cloud?

[Pascal Hdz]

Hello Min Kim,

You don't need to do the step 3 and 4 that you mention in your ticket description. The auto-onboarding will handle a remote provisioning of your device so please avoid doing it locally.

Please follow the next steps:

• Select and unclaim the device from the claimed devices list: https://app.nrfcloud.com/#/claimed-devices
• Install nRF Cloud Utils and delete the provisioned certificates with the next command:

nrfcredstore <YOUR_PORT> deleteall

• Repeat the auto-onboarding process. You could repeat the process you did before or use nRF Cloud Utils as described in our documentation: https://docs.nordicsemi.com/bundle/nrf-cloud/page/GettingStarted.html#provision-one-device-using-provisioning-service

Regards,

Pascal.

[Pascal Hdz]

Hello Min Kim,

Do you still need help on this or can we close this ticket?

Regards,

Pascal.