Azure Iot Hub certificate generation on nRF52840

RE: Azure Iot Hub certificate generation on nRF52840

Øyvind — Tue, 05 May 2026 14:06:44 GMT

Hello,

[quote user="buh"]In both cases I would like to use the Azure IoT Hub library, how can this be achieved?[/quote]

As we have no similar solutions made by us we recommend looking at other tls_credential backends and replicate that into your shell integration. E.g. tls_credentials_shell and tls_credentials_subsystem

Have a look at the MQTT sample in Zephyr: zephyr/samples/net/mqtt_publisher/src/main.c

Kind regards,
Øyvind

RE: Azure Iot Hub certificate generation on nRF52840

buh — Tue, 28 Apr 2026 16:25:19 GMT

Hi!

[quote userid="77062" url="~/f/nordic-q-a/127897/azure-iot-hub-certificate-generation-on-nrf52840/565594"]For the nRF54 series this is handled by the SDK.[/quote]

May I ask for more details on how this could be done using the tls_credentials library and e.g. the shell?

[quote userid="77062" url="~/f/nordic-q-a/127897/azure-iot-hub-certificate-generation-on-nrf52840/565594"]For nRF52840, you will need to use some other means to store the credentials.[/quote]

When using the nRF52840, I could use an additional external flash to store the certificates and also e.g. a shell to transfer the credentials.

In both cases I would like to use the Azure IoT Hub library, how can this be achieved?

Best regards
Bernhard

RE: Azure Iot Hub certificate generation on nRF52840

Øyvind — Tue, 28 Apr 2026 07:21:14 GMT

Hello Bernhard,

[quote user="buh"]like a nRF70 series device, because the Azure certificates need to be stored on the host controller in any case.[/quote]

Yes, this is correct. Our steps under e.g. Generate and provision device certificates includes steps for the nRF70 but should also work for e.g. W5500 when building for your target device.

[quote user="buh"]Lets assume I would use a nRF54 series SoC, would there be another way for certificate generation[/quote]

There isn't much of difference in how the certificates are generated, but the difference is where they are stored. The newer devices have a PSA secure storage backend for the tls_credentials. The tls_credentials library supports runtime provisioning using for instance shell or their own transport of choice, so the firmware can be the same for all.

For the nRF54 series this is handled by the SDK. For nRF52840, you will need to use some other means to store the credentials. Settings subsystem is probably usable, but this is not something we have added support for. That would store the credentials in plain text, but at least allow for runtime provisioning.

Kind regards,
Øyvind

RE: Azure Iot Hub certificate generation on nRF52840

buh — Mon, 27 Apr 2026 14:40:11 GMT

Hi!

Thanks for the quick answer!

I understand you are not supporting the W5500 ethernet controller, but I think it should make no difference using the W5500 or any other external ethernet or Wi-Fi controller, like a nRF70 series device, because the Azure certificates need to be stored on the host controller in any case.

Lets assume I would use a nRF54 series SoC, would there be another way for certificate generation and provisioning beside the "nRF70: Script generated private key" option, which would allow the exact same firmware to be used for many devices? If yes, I would appreciate it if you could provide further details on how this can be done.

Best regards
Bernhard

RE: Azure Iot Hub certificate generation on nRF52840

Øyvind — Fri, 24 Apr 2026 12:00:19 GMT

Hello,

We do not have support for the W5500 ethernet device.

is there a reason for why you are using the nRF52840 and not a newer device with a more security in regards to storing the certificate? I.e. our nRF54 series includes Trustzone which can be used to store certificates more securely. The nRF70 sample uses the nRF7002DK which has the nRF5340 as main device. See requirements under Azure IoT Hub sample. This sample also uses the cert_tool.py script

From what I can tell, the nrfcredstore tool is not designed to work with other devices than nRF91. From Github repo:

nrfcredstore is a command line tool that simplifies managing credentials stored in Nordic Semiconductor modems, like the nRF9151. The typical use case of nrfcredstore is to automate the provisioning of cloud certificates that are stored securely in the modem.

Kind regards,
Øyvind