RE: nRF Cloud CoAP connection fails with err -111 (self-signed CA certificate)

Pascal Hdz — Wed, 08 Apr 2026 08:09:33 GMT

Hello Min Kim,

Do you still need help on this or can we close this ticket?

Regards,

Pascal.

RE: nRF Cloud CoAP connection fails with err -111 (self-signed CA certificate)

Pascal Hdz — Fri, 27 Mar 2026 09:40:33 GMT

Hello Min Kim,

You don't need to do the step 3 and 4 that you mention in your ticket description. The auto-onboarding will handle a remote provisioning of your device so please avoid doing it locally.

Please follow the next steps:

Select and unclaim the device from the claimed devices list: https://app.nrfcloud.com/#/claimed-devices
Install nRF Cloud Utils and delete the provisioned certificates with the next command:

nrfcredstore <YOUR_PORT> deleteall

Repeat the auto-onboarding process. You could repeat the process you did before or use nRF Cloud Utils as described in our documentation: https://docs.nordicsemi.com/bundle/nrf-cloud/page/GettingStarted.html#provision-one-device-using-provisioning-service

Regards,

Pascal.

RE: nRF Cloud CoAP connection fails with err -111 (self-signed CA certificate)

mincom — Thu, 26 Mar 2026 20:21:51 GMT

Update: Still getting -111 error after nRF Cloud auto-onboarding

I tried a different approach using the attestation token and "Create new rule for onboarding to nRF Cloud" option as described in the nRF9151 Connect Kit guide.

Steps I followed:

Flashed nrf_provisioning sample to custom board
Got attestation token using nrf_provisioning token command
In nRF Cloud UI: Claim Device → pasted attestation token → enabled "Create new rule for onboarding to nRF Cloud" → Create Rule and Claim Device
Rebooted device - provisioning completed successfully
nRF Cloud UI shows device status as READY with:
- Cloud Access Key Generation: Succeeded
- Server Certificate: Succeeded (Generated for nRF Cloud auto-onboarding)
- Client Certificate: Succeeded (Generated for nRF Cloud auto-onboarding)

Verification:

AT%CMNG=1,16842753

%CMNG: 16842753,0,"F6EEF665B61C4F9852AC3C84747D0EE92D0E79B24C187ABB7CEEF7A85E173534"

%CMNG: 16842753,1,"E882E67370D8457A30341D0FC89E1E0E5D95F517263578A1DE547A459E0F1662"

%CMNG: 16842753,2,"79EB6167AACF3A9333FFA8CF9F15EC351AF898F637499264B94F4F77444D59A0"

Server CA (Type 0) content is identical to factory-provisioned Thingy:91 X (SEC_TAG 4242):

Amazon Root CA 1
nRF Cloud CoAP CA

But still getting -111 error:

nrf_cloud_coap_transport: Could not connect to nRF Cloud CoAP server coap.nrfcloud.com, port: 13334. err: -111

Additional observation:

Factory Thingy:91 X with SEC_TAG=4242 → Works ✓
Factory Thingy:91 X with SEC_TAG=16842753 (auto-onboarded) → Does NOT work ✗
Custom board with SEC_TAG=16842753 (auto-onboarded) → Does NOT work ✗

It seems like the Client Certificate signed by nRF Cloud auto-onboarding is being rejected during TLS handshake, even though the Server CA is correct.

Questions:

Is there a difference between factory-provisioned certificates (SEC_TAG 4242) and auto-onboarded certificates (SEC_TAG 16842753)?
Is there any additional configuration needed for auto-onboarded devices to use CoAP?
How can I verify that the Client Certificate is correctly signed and trusted by nRF Cloud?