I need an architectural guide and recommended workflow for setting up post-production (in-field) cryptographic key provisioning on Nordic nRF devices (nRF9160 and nRF9151) upon their initial network connection.
While I plan to use nRF Cloud and Memfault for device management and telemetry, our core application data must route through a separate, custom MQTT broker utilizing the public key generated during the provisioning process.
Please address the following requirements:
-
Provisioning Workflow: How to trigger and execute over-the-air (OTA) cryptographic key provisioning or certificate injection once the device establishes its initial network connection.
-
Integration Strategy: How to leverage nRF Cloud for this provisioning flow while maintaining a completely separate custom MQTT broker for standard application traffic using the newly provisioned keypair.
-
Notifications & Key Retrieval: How to receive a notification when the provisioning process completes and how to programmatically access the generated public key for use with the custom MQTT broker.
-
Security & SDK Configs: Essential security considerations and specific nRF Connect SDK configurations required to handle keys securely during late-binding field provisioning.