NRF9160 Certificate provisioning (CSR) With RSA keys

RE: NRF9160 Certificate provisioning (CSR) With RSA keys

Simon D-M — Thu, 23 Apr 2026 07:51:16 GMT

Hi Martin,

We currently don't have any sample that shows how to generate an RSA key. The closest sample I found is "Crypto: RSA" which does not show how to generate the RSA key but shows how to use it. It shouldn't be too hard to modify this sample in order to replace importing the key by generating the key.

If you need help modifying the sample feel free to ask.

Best regards,

Simon D-M

RE: NRF9160 Certificate provisioning (CSR) With RSA keys

Martin Hauser — Wed, 22 Apr 2026 12:27:19 GMT

Hi Simon

Thanks for the clarification.

We don't have control over the IOT hub, another company manages that, we are hoping that they can support ECDSA but we are waiting on a response from them.

The statement that the Hub only accepts RSA key is not something we have/can confirm, but the fact that it works with a cert using RSA makes us believe that it's true. We know the root CA uses RSA unlike in the documentation you mentioned.

We will try to implement key generation in application if out cloud partner can't make is work with ECDSA. Is there any samples showing how to generate the keys/cert?

- Martin

RE: NRF9160 Certificate provisioning (CSR) With RSA keys

Simon D-M — Wed, 22 Apr 2026 12:01:30 GMT

Hi Martin,

I'm not too familiar with Azure IoT Hub, but I saw there were some documentation for generating keys for Azure IoT Hub (link). However, I think it uses elliptic curve keys, so are you sure that you can't configure your Hub to work with ECDSA keys ?

Anyway, I don't think that there is a direct way to generate an RSA key directly inside the modem like with the ECDSA keys. However, the nRF9160 Crypto peripheral supports RSA key generation (link). You should be able to generate the key inside on the application core and then send it to the modem. I don't know if this is safe enough for you as the key is present on the application core for a small amount of time.

Best regards,

Simon D-M