RE: Securest way to use TLS in MQT

Øyvind — Mon, 22 Mar 2021 10:22:58 GMT

Hello, my apologies for the late reply.

The alternative is to flash the certificates using pynrfjprog or the certificate manager in the lte link monitor. The code that writes credentials to the modem at boot can then be removed. As long as the sec tag used in the TLS connection matches the sec tag used when flashing the certificates it should be all good.

When we produce DKs and Thingy91s, certificates are provisioned in the factory using AT commands. So they're stored securely in the modem only, and no private keys or anything in app flash/RAM

[quote user=""]Thats why you have a very large warning in the AWS_FOTA example saying that this is not best practice.[/quote]

Yes, we encourage customers to follow warnings and notes in our documentation.

KInd regards,
Øyvind

RE: Securest way to use TLS in MQT

Jupyter1336 — Mon, 22 Mar 2021 10:13:08 GMT

Thnx

RE: Securest way to use TLS in MQT

Øyvind — Thu, 18 Mar 2021 08:59:30 GMT

Hello,

I've forwarded you questions to our MQTT experts. And will reply today or tomorrow.

Kind regards,
Øyvind