Hi
We have a fleet of nRF9160-based sensors in the field (mfw 1.3.x, NCS 2.7.0) with ab Azure IOT Hub Connection over MQTT / TLS.
For FOTA we are using azurewebsites.net
Azure replaced the default *.azurewebsites.net certificate. Our FOTA host now sends this chain:
leaf → Microsoft TLS G2 RSA CA OCSP 10 → Microsoft TLS RSA Root G2 (cross-signed) → DigiCert Global Root G2, about 6.8 KB.
Since the change, every FOTA download fails with errno 111 during the TLS handshake. The trust anchor (DigiCert Global Root G2) is provisioned and still valid. We think the cause is the 4 KB server chain limit in mfw 1.3.x. We worked around it for FOTA with a custom domain and our own short certificate chain.
For the FOTA's we have fixed this issue with a custom domain and our own short certificate chain, but our concern is the IoT Hub connection.
The whole fleet is depended on the IOT hub connection (Device twin/ shadow, C2D messages, Telemetry data) and the current chain sizes are for RSA 3.0 KB and for ECDSA 3.6KB.
Potential fixes:
Using Mbed TLS, is not possible because the private device key for the TLS handshake is stored within the modem.
We can implement a ECDSA / RSA fallback so we can use a fallback chain, but we have no guaranties always one of the chains is less than the 4KB limit.
Questions:
1. How do you see this risk for nRF9160 devices connecting to Azure Iot hub?
2. What do you recommend as a back-up plan?
For your understanding: if our IOT hub connection is bricked, we have to recall our devices because we are not able to update the firmware anymore.