Verifying Public and Private Certificates

RE: Verifying Public and Private Certificates

Manu — Thu, 27 Mar 2025 21:02:32 GMT

Hi,

I came across this thread because I was trying to ensure that the creds we generate ( externally) are making it into the device properly.
In doing so, I found myself unable to generate(from the files I downloaded) a matching hash for the cert installed onto the device. ( Specifically, I expect to generate a hash to match what was written into slot 100, type 1.

To my surprise, I noted that the hash I was able to generate for the ROOT_CA_CERT MATCHES one of the (auto-installed?) type 10 credentials in the (default?) sec_slot.

So, in summary, How do I generate the SHA key that the device returns on a AT%CMNG=1, so I can verify the same key exists?

Any other information about what the autogenerated tags mean would also be illustrative

RE: Verifying Public and Private Certificates

Raoul — Fri, 18 Nov 2022 14:40:29 GMT

Hi,

You will have to upgrade the modem firmware to the newest version, v1.3.2, and then list these certificates to do your comparison.

MODEM_KEY_MGMT_CRED_TYPE_PUBLIC_CERT and MODEM_KEY_MGMT_CRED_TYPE_PRIVATE_CERT can't be read, they can be listed. Listing them will include the <sha> which you can use for your comparison. See chapter 12.8 here: https://infocenter.nordicsemi.com/pdf/nrf91_at_commands_v2.1.pdf

Unfortunately, the sha hash is only listed correctly in v1.3.2, so an upgrade will be necessary.

Best regards,

Raoul

RE: Verifying Public and Private Certificates

kkksss — Mon, 14 Nov 2022 21:41:00 GMT

Actually correction to above, the modem_key_mgmt_cmp and modem_key_mgmt_read cannot read the keys MODEM_KEY_MGMT_CRED_TYPE_PUBLIC_CERT and MODEM_KEY_MGMT_CRED_TYPE_PRIVATE_CERT.

I tested the following and it works successfully in comparing and reading MODEM_KEY_MGMT_CRED_TYPE_CA_CHAIN.

The AT command behind the scenes is

AT%CMNG=2,?,?