Connect to nRF cloud using eSIM.

[Stas Jis]

We are using nRF9160 chip (in own custom board), SDK 1.9.1 board with "serial lte modem" firmware.
We are unable to get coordinates using AGPS.
I suppose this is due to the fact that the eSIM needs to be somehow registered on the nRF Cloud.
We used the sequence of commands from the "GNSS_AT_commands" example:

  AT%XSYSTEMMODE=1,0,1,0

  OK
  AT%XCOEX0=1,1,1565,1586

  OK
  AT+CPSMS=1

  OK
  AT+CFUN=1

  OK
  AT#XNRFCLOUD=1

  OK

  AT#XAGPS=1,1
  ERROR
  
  AT#XNRFCLOUD?
  #XNRFCLOUD: 0,0,16842753,"nrf-350916060695718" 

But there is no connection to the nRF cloud. eSIM is already used to upload / unload  data via MQTT using AT commands, so the SIM card is working.

[Stas Jis]

Dear Øyvind:

Let's go through the entire scenario from the beginning.
Because at some stage there is definitely a problem.

We are using "serial_lte_modem" firmware, using an external MCU and indicating that we are using our Security tag:
CONFIG_NRF_CLOUD_AGPS=y
CONFIG_SLM_CONNECT_UART_2=y
CONFIG_UART_2_NRF_HW_ASYNC_TIMER=2
CONFIG_SLM_AGPS=y
CONFIG_NRF_CLOUD_SEC_TAG=321

prj.conf file: 

#
# Copyright (c) 2020 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#
# General config
CONFIG_LOG=y
CONFIG_LOG_DEFAULT_LEVEL=3
CONFIG_STACK_SENTINEL=y
CONFIG_NEWLIB_LIBC=y
CONFIG_NEWLIB_LIBC_FLOAT_PRINTF=y
CONFIG_RING_BUFFER=y

# Segger RTT
CONFIG_USE_SEGGER_RTT=y
CONFIG_RTT_CONSOLE=y
CONFIG_UART_CONSOLE=y
CONFIG_LOG_BACKEND_RTT=n
CONFIG_LOG_BACKEND_UART=y

# Network
CONFIG_NETWORKING=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_NATIVE=n

# Modem library
CONFIG_NRF_MODEM_LIB=y
# Align the max FD entry to NRF_MODEM_MAX_SOCKET_COUNT(8)
CONFIG_POSIX_MAX_FDS=8
# Enable below for modem trace
#CONFIG_NRF_MODEM_LIB_TRACE_ENABLED=y

# Use GPIO
CONFIG_GPIO=y
CONFIG_GPIO_NRFX=y

# UART interface
CONFIG_SERIAL=y
CONFIG_UART_ASYNC_API=y
CONFIG_NRFX_TIMER2=y

# Stacks and heaps
CONFIG_MAIN_STACK_SIZE=4096
CONFIG_HEAP_MEM_POOL_SIZE=16384
CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=4096

# Device power management
CONFIG_PM_DEVICE=y

# FOTA
CONFIG_HTTP_PARSER_URL=y
CONFIG_FOTA_DOWNLOAD=y
CONFIG_FOTA_DOWNLOAD_PROGRESS_EVT=y
CONFIG_DFU_TARGET=y
CONFIG_DOWNLOAD_CLIENT=y
CONFIG_DOWNLOAD_CLIENT_STACK_SIZE=4096
CONFIG_BOOTLOADER_MCUBOOT=y
CONFIG_IMG_MANAGER=y

# FLASH
CONFIG_FLASH=y
CONFIG_FLASH_PAGE_LAYOUT=y
CONFIG_FLASH_MAP=y
CONFIG_MPU_ALLOW_FLASH_WRITE=y
CONFIG_IMG_ERASE_PROGRESSIVELY=y

# Settings
CONFIG_SETTINGS=y
CONFIG_SETTINGS_FCB=y
CONFIG_FCB=y

# nRF Cloud
CONFIG_CLOUD_API=y
CONFIG_NRF_CLOUD_MQTT=y
CONFIG_NRF_CLOUD_FOTA=n
CONFIG_NRF_CLOUD_AGPS=y
CONFIG_NRF_CLOUD_PGPS=y
CONFIG_NRF_CLOUD_CELL_POS=y
CONFIG_NRF_CLOUD_LOG_LEVEL_INF=y
CONFIG_DATE_TIME=y
CONFIG_MODEM_INFO=y
CONFIG_MODEM_INFO_ADD_DATE_TIME=n
CONFIG_AT_MONITOR=y
CONFIG_MODEM_JWT=y
# Use "nrf-<IMEI>" as the default device_id format
# Use "<device_uuid>" as the device_id format by below
#CONFIG_NRF_CLOUD_CLIENT_ID_SRC_INTERNAL_UUID=y

#
# SLM-specific configurations
#
CONFIG_SLM_CUSTOMIZED=n
CONFIG_SLM_LOG_LEVEL_INF=y
CONFIG_SLM_EXTERNAL_XTAL=n
CONFIG_SLM_START_SLEEP=n
#\nUse\nUART_0\n(when\nworking\nwith\nPC\nterminal)
#CONFIG_UART_0_NRF_HW_ASYNC_TIMER=2
#\nUse\nUART_2\n(when\nworking\nwith\nexternal\nMCU)
CONFIG_SLM_CONNECT_UART_2=y
CONFIG_UART_2_NRF_HW_ASYNC_TIMER=2
#\nnRF\nCloud\nbased\nlocation\nservices
CONFIG_SLM_AGPS=y
CONFIG_SLM_PGPS=y
CONFIG_SLM_CELL_POS=y
CONFIG_SLM_LOG_LEVEL_DBG=y
CONFIG_NRF_CLOUD_LOG_LEVEL_DBG=y
CONFIG_NRF_CLOUD_SEC_TAG=321

nrf9160dk_nrf9160_ns.conf file:

#
# Copyright (c) 2021 Nordic Semiconductor ASA
#
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
#

# Configuration file for nRF9160DK.
# This file is merged with prj.conf in the application folder, and options
# set here will take precedence if they are present in both files.

# Use UART_0 (when working with PC terminal)
# unmask the following config
#CONFIG_SLM_CONNECT_UART_0=y
#CONFIG_UART_0_NRF_HW_ASYNC_TIMER=2
#CONFIG_UART_0_NRF_HW_ASYNC=y
#CONFIG_SLM_INTERFACE_PIN=6

# Use UART_2 (when working with external MCU)
# unmask the following config
CONFIG_SLM_CONNECT_UART_2=y
CONFIG_UART_2_NRF_HW_ASYNC_TIMER=2
CONFIG_UART_2_NRF_HW_ASYNC=y
CONFIG_SLM_INTERFACE_PIN=31

When starting the device, we execute the following commands to install our certificates:

AT%CMNG=0,321,0, ...
OK

AT%CMNG=0,321,1, ...
OK

AT%CMNG=0,321,2, ...
OK

AT%CMNG=0,321,1, ...

Results of the AT%CMNG=1 command:

%CMNG: 0,6,"0606060606060606060606060606060606060606060606060606060606060606"
%CMNG: 321,0,"0000000000000000000000000000000000000000000000000000000000000000"
%CMNG: 321,1,"0101010101010101010101010101010101010101010101010101010101010101"
%CMNG: 321,2,"0202020202020202020202020202020202020202020202020202020202020202"
%CMNG: 654321,0,"000000000000000000000000000000000000000000000000000000000000000
0"
%CMNG: 654321,1,"010101010101010101010101010101010101010101010101010101010101010
1"
%CMNG: 654321,2,"020202020202020202020202020202020202020202020202020202020202020
2"
%CMNG: 4294967293,10,"0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A0A
0A0A0A"
%CMNG: 4294967292,11,"0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B0B
0B0B0B"
OK

I see that there is no data for tag 16842753.
As I understand it, we do not have certificates for accessing the nRF cloud. How can we get them back?

Next, we execute a sequence of commands to use AGPS (from the GNSS_AT_commands.rst example):

AT%XSYSTEMMODE=1,0,1,0

OK
AT%XCOEX0=1,1,1565,1586

OK
AT+CPSMS=1

OK
AT+CFUN=1

OK
AT#XNRFCLOUD=1

OK

Receiving in response:

#XNRFCLOUD: 0,0

#XNRFCLOUD: 0,0

How did you write:
The first AT#XNRFCLOUD=1 command initiates the connection to the cloud. on the initial connection, the JITP step is performed and nRF Cloud immediately disconnects the device, hence the #XNRFCLOUD: 0,0 responses.

After that, I try to add my user device to the nRF cloud using the user ID (not IMEI, used the device ID, the same one used when generating certificates) and any password as you said earlier:
For you custom board you can choose a Device ID that fits your application along with a PIN/HWID of your choice.

Any attempts to add a devay give an error code: Code 40412.

Naturally, repeated execution of the AT#XNRFCLOUD=1 command does not give access to the cloud.

What are we missing? Why we cannot registration the device in nRF Cloud? and continue to use AGPS?

[Stas Jis]

Øyvind,
I'm trying to follow your instructions, but it doesn't work so far.
After generating certificates, I see that the generated file contains two client certificates, is this correct? do they both need to be specified when renewing certificates?

 "clientCert":"
 -----BEGIN CERTIFICATE-----\n
MIICrTCCAZUCCQCVEZ65+2tKnjANBgkqhkiG9w0BAQsFADBwMQswCQYDVQQGEwJO\nTzEPMA0GA1UECAwGTm9yd2F5MRIwEAYDVQQHDAlUcm9uZGhlaW0xHTAbBgNVBAoM\nFE5vcmRpYyBTZW1pY29uZHVjdG9yMR0wGwYDVQQLDBRucmZjbG91ZC5jb20tR2Vu\nZXJpYzAgFw0yMjA0MTAxMDQ3NDNaGA8yMDUyMDQwMjEwNDc0M1owgYkxCzAJBgNV\nBAYTAk5PMRIwEAYDVQQIDAlUcm9uZGVsYWcxEjAQBgNVBAcMCVRyb25kaGVpbTEh\nMB8GA1UECgwYTm9yZGljIFNlbWljb25kdWN0b3IgQVNBMRwwGgYDVQQDDBNQZXRw\nYWNlXzk5ODU2M19UZXN0MREwDwYDVQQuEwg3NTc0NzcyMzBZMBMGByqGSM49AgEG\nCCqGSM49AwEHA0IABHAVnIhrjYob9EwqYdoYt40HpEX4e/Wcm8y8l9kpTUhR7Gtg\nqcjlI33kIaqv/wiDfsK6Se9iDng7YxzFBZfiUpwwDQYJKoZIhvcNAQELBQADggEB\nAB/cGYQW5n2s3yL9T2FHUPu7Rnn4Edx9Bv/Z6Ab7Y49I7rOQLaDupWU6ghB/tqcZ\n5CuiAIj8R1m+KIvQPjaK5igpFc+CtyL8OYZiq/uwedp/f/MYrJ2FBugRLZg+LF3n\nCfYALlQs9vwtUB1YB1rwhZ38zq5LWN07aqq56pR6V+JBSuwwLt6mXqfzPaVOWSrp\nhf9Ma+7YLfbDX2xRTR6O8v0bhbcM708EWeVxPSfnu8Bn+OMPYGXfpaZx9gMWKNu4\nH3jt6CD15D2gZzgZ+FXDlc+lM58DvVj9Yg6G/dCh2GNku+5ELUuzZ1Zu50fNCgy+\n108I9Iah1i43JpoOfy9Jw/0=\n-----END CERTIFICATE-----\n
-----BEGIN CERTIFICATE-----\n
MIIDszCCApugAwIBAgIJAIt6VMjGN2CzMA0GCSqGSIb3DQEBCwUAMHAxCzAJBgNV\nBAYTAk5PMQ8wDQYDVQQIDAZOb3J3YXkxEjAQBgNVBAcMCVRyb25kaGVpbTEdMBsG\nA1UECgwUTm9yZGljIFNlbWljb25kdWN0b3IxHTAbBgNVBAsMFG5yZmNsb3VkLmNv\nbS1HZW5lcmljMB4XDTE5MDkxMTE4NTUyOVoXDTIyMDcwMTE4NTUyOVowcDELMAkG\nA1UEBhMCTk8xDzANBgNVBAgMBk5vcndheTESMBAGA1UEBwwJVHJvbmRoZWltMR0w\nGwYDVQQKDBROb3JkaWMgU2VtaWNvbmR1Y3RvcjEdMBsGA1UECwwUbnJmY2xvdWQu\nY29tLUdlbmVyaWMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPgb/l\n/0me0+ySVzZeSRQ5vkYfYjNwJYv3UVbN1QaP00YNKCathNlKMPZOv39PUmld9eaN\nGoQJw7Tc8oXFGZrllc7fdJD2YBmp9uot4hwXWUMKX+xkquC7XQFvLeOkJHaNUU4k\ny03vMqC/RDsA+xtexvbwp6+Vu6hr7Uil57mFceV456iXBiDLnmhsww9HtF7iP1ne\n56pijtGRi0mM9OfWIrO+yKoRp+KUUszDCIXBhFSdtzoeUlp//NIWBT96tE1oQnv2\nI9NwU0b96A7BccWdMzDAiJEbSzBFpQQlhDAUcu5KlDMrF/V4YcyQ5tZRI1FEalOV\n9FX1P+st+E07gEyJAgMBAAGjUDBOMB0GA1UdDgQWBBQeOm/kNx7xB/1VOMGIur0S\n+jTe2TAfBgNVHSMEGDAWgBQeOm/kNx7xB/1VOMGIur0S+jTe2TAMBgNVHRMEBTAD\nAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBp4VP939aKCocGmVrAcaEwemrce37gR9Fr\ncAZMQ9G0Uq4Rketah72D5oqIZFI7pQ/KLbxetzfziH74jv3hxYofraJCvyEOgJfs\n708vSZdLJHRHXIghpvFOSXrrsyU/oRfxp+iZNGCk7AdMYHRUom+gjYfb5/2eiZXW\nDsDwHnLFSA8nIk9D3YH/5hM8uny94LijW41r5RO33Sk3gM9X3afYUp0rdpg0sRBq\nme25iMVsFwCmWfMbmfjOTDHVWnoU6ZPa+4QyekzDdJW4gLLJRDR0mVWD8lEoIyhV\njzV+sF0OhtHgMgnAkUUU05UCqi8gWuC+qtimwx80X+ETCq4jpGqj\n
-----END CERTIFICATE-----\n"

Where do you specify the Security tag when adding a device?
I don't see the option to specify a security tag in the add LTE device window.
The device still cannot be added to the nRF cloud.

[Øyvind]

Hello, 

Stas Jis said:

After generating certificates, I see that the generated file contains two client certificates, is this correct?

Generating the certificates as described in my previous comment, will generate a .json file including certificates. You can import this .json file to the Certificate Manager found in LTE Link Monitor. 

Stas Jis said:

Where do you specify the Security tag when adding a device?

The serurity tag (sec_tag) is only specified when provisioning certificates to your device, i.e. using he Certificate Manager. This number will provide a location to the certificates which you can instruct your program to use i.e. CONFIG_NRF_CLOUD_SEC_TAG=<provided sec tag>

Stas Jis said:

I don't see the option to specify a security tag in the add LTE device window.

No, this is correct. The Add LTE Device window in nRF Cloud only refers to the Device ID and PIN/HWID that you provided when creating the certificate

It is important that you use the same device id and pin/hwid in both forms.

Stas Jis said:

The device still cannot be added to the nRF cloud

What error do you get? Have you ensured that you are pointing to the correct certificate using CONFIG_NRF_CLOUD_SEC_TAG=<provided sec tag> in your application?