Sample Azure IoT Hub (Thingy9.1)

[ActiTAG]

Hello,

I have the same problem as this topic: https://devzone.nordicsemi.com/f/nordic-q-a/77267/nrf9160-azure-iot-hub-on-thingy91-mqtt-connect-error

I'm using nrf Connect v3.7.1, LTE link monitor v1.1.10. I made the last firmware update 2021-10-20. Sample in the ncs v1.7.1.

Maybe I forgot a step?

Here are the steps I did:

- prj.conf : add the CONFIG_AZURE_IOT_HUB_DEVICE_ID & CONFIG_AZURE_IOT_HUB_HOSTNAME & CONFIG_AZURE_IOT_HUB_DPS=y & CONFIG_AZURE_IOT_HUB_DPS_ID_SCOPE

- certificates.h: change name file and add the ca cert, client key and cert. I add it also with LTE link monitor to be sure.

If you have any useful tips or information, thank you in advance for your help!

Voici mes logs et traces :

trace-2021-11-16T15-37-04.024Z.bin

[Sigurd Hellesvik]

Hi Acti,

Error -111 means that the Azure cloud is refusing your connection.

Have you followed the steps found at our Azure IoT Hub documentation?

Regards,
Sigurd Hellesvik

[ActiTAG]

Hi ! Yes I follow all the step and check it once again but the result is the same. I have a python script on my computer using the Azure SDK that made provisioning and data sending to my IoT Hub. I have the same CA, I create the certificate for the Thingy and upload it with the same sec_tag in the prj.conf. I don't know where to look, I double check all point...

[Sigurd Hellesvik]

Hi Acti,

I am not able to open your trace. Are you able to open the trace file you added in our Trace Collector (From nRF Connect for Desktop)?

You should have three certificates for the nRF9160: private+key generated from the Tutorial: Using Microsoft-supplied scripts to create test certificates, and a CA, which is the Baltimore CyberTrust Root, right?

Then on the Azure Cloud DPS side, you create a enrollment group which has the  root CA cert generated from the scripts.

To take a step beack, are you able to make Azure IoT Hub work without DPS?

Regards,
Sigurd Hellesvik

[ActiTAG]

Hi, 

I can't open my trace.  

Hum I follow this tutorial to generate certificates : Tutorial - Use OpenSSL to create X.509 test certificates for Azure IoT Hub | Microsoft Docs

I'm not able to make it works without DPS too. Same error in mqtt connect error. 

[Sigurd Hellesvik]

Hi,

Are you using the Baltimore CyberTrust Root for anything?

Regards,
Sigurd Hellesvik

[ActiTAG]

Hi !

No I don't use it. With my python script using the SDK I don't need to use it. Is it the case for the thingy ?

Thank you in advance.

[Sigurd Hellesvik]

Hi Acti,

Your client need to trust the Azure IoT Hub to connect to it.
To check this trust, the device needs the Baltimore CyberTrust Root certificate.
So the CA certificate that you provision to the device is not the CA you generated, but the Baltimore CyberTrust Root certificate.

Regards,
Sigurd Hellesvik

[ActiTAG]

So I need to used this one azure-iot-sdk-c/certs.c at master · Azure/azure-iot-sdk-c · GitHub rather than my generated CA upload on DPS ?

[Sigurd Hellesvik]

Hi

* You can also upload client public keys to the Server.

Does this make sense?

Regards,
Sigurd Hellesvik

[ActiTAG]

Ok so, the CA server is the certifcate found here azure-iot-sdk-c/certs.c at master · Azure/azure-iot-sdk-c · GitHub give to the device as CA cert . I gave the CA generated that correspond to the CA device to Azure cloud.
If what I write is correct then I don't understand why I still have error  -111...

Thank you in advance for your reply.

[Sigurd Hellesvik]

Hi Acti,

On your device, you have 3 certs, from the following places:

Client cert: Generated by you
Client Key: Generated by you
CA cert: Baltimore CyberTrust Root certificate*

For DPS group enrollment the server should have 1 cert:

Root/Intermediate CA cert: Generated by you

Our documentation advises to use this tutorial to generate certs. You can use other methods, but I advise to use this method first, to see that everything works.
(* Same about the Baltimore CyberTrust Root; You could possibly be able to use other certs in place of this. But we know that the Baltimore CyberTrust Root works, so at least use this for the first tests, just to see that everything works.)

If you are still not able to make it work with the above settings, I advise you to try and make the IoT Hub work without DPS first.
DPS adds a layer of complexity, and will make the issue harder to debug.

Regards,
Sigurd Hellesvik