nRF91 How to use Google's primary and backup root CA on the modem?

[PopradiArpad]

Hi,

I want to connect to Google Cloud IoT with a modified asset_tracker and want the TLS done by the modem like in asset_tracker.

Google has a primary and a backup root CA for IoT and they may switch between the primary and backup certificates at any time without notice

See here cloud.google.com/.../mqtt-bridge

Is it enough to install these certificates (in the right converted form) as type 0 with different sec_tags on the modem?

I hope :)

With kind regards,

Árpád

[Simon]

I talked to a developer and got some insight.

Modem firmware version 1.2.0 does not use SNI, so that may be the cause of the issue. This should be resolved in the next modem firmware release. We'll inform you when it gets released.

Best regards,

Simon

[PopradiArpad]

Hi Simon,

thank you.

Best regards,

Árpád

[Didrik Rokhaug]

Hi.

Modem firmware version 1.2.1, which has support for SNI has just been released.

https://www.nordicsemi.com/Software-and-tools/Development-Kits/nRF9160-DK/Download#infotabs

Best regards,

Didrik

[PopradiArpad]

Hi Didrik,

thank you for your answer and sorry for my late one. I will try it.

Best regards,

Árpád

[mike-at-currant]

Hi there Arpad,

Were you ever able to get the LTS version of Google IoT Core (using mqtt.2030.ltsapis.goog using the primary and backup certs) working with Modem firmware version 1.2.1?

I have tried and have been unsuccessful, and was suspecting that the modem firmware doesn't support the TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 cipher suite.