How to set AWS IoT certificates in runtime

RE: How to set AWS IoT certificates in runtime

choehyunho — Tue, 20 Dec 2022 11:03:55 GMT

Oh, thanks.

I added the following line in my prj.conf

CONFIG_AWS_IOT_CERTIFICATES_FILE="aws-certs.h"

checked the following line in my CMakeLists.txt

zephyr_include_directories_ifdef(CONFIG_AWS_IOT_PROVISION_CERTIFICATES certs)

and put my own aws-certs.h in cert folder.

It is because my firmware will include claim certificates by default for initial connection, and load/save from NVS if needed.

Basically the combined approach you suggested.

Now I can use all my features without nasty modification. Thank you!

RE: How to set AWS IoT certificates in runtime

Susheel Nuguru — Tue, 20 Dec 2022 06:28:17 GMT

My Colleague who have some experience in this thinks it can be done. Suggestion from him is below .

Okay, so the library can actually handle the loading of the credentials for you. As you have already found out, it does that by writing the contents of some buffers it assumes exists in aws-certs.h (you can change the name of the file with a Kconfig option). So the user can define those buffers in a way that makes the application capable of changing their contents. The content of the buffers are loaded each time the application calls aws_iot_connect()

The other option is what I thought you had to do, which is to load the credentials yourself (in the application), before you call aws_iot_connect(). This approach gives more flexibility, but you will have to do all the credential handling yourself

RE: How to set AWS IoT certificates in runtime

choehyunho — Mon, 19 Dec 2022 16:38:19 GMT

It may be more practical, not just for sample, if runtime certificate loading is possible.

Hope some knit & clean way provided in the future NCS release.

RE: How to set AWS IoT certificates in runtime

Susheel Nuguru — Mon, 19 Dec 2022 06:31:11 GMT

[quote user="choehyunho"]Is there any better way? Or can you suggest how I can access these variable without modifying NCS codes?[/quote]

Not that I know of, but I can ask my colleague just to be sure.

RE: How to set AWS IoT certificates in runtime

choehyunho — Sat, 17 Dec 2022 11:51:35 GMT

For the certificate change, I made some quick dirty workaround on aws-certs.h

//static const unsigned char ca_certificate[] = {
unsigned char ca_certificate[2048] = {
...
//static const unsigned char private_key[] = {
unsigned char private_key[2048] = {
...
//static const unsigned char device_certificate[] = {
unsigned char device_certificate[2048] = {
...

With this workaround, I can access these variables in my application code.

extern unsigned char ca_certificate[2048];
extern unsigned char private_key[2048];
extern unsigned char device_certificate[2048];

Is there any better way? Or can you suggest how I can access these variable without modifying NCS codes?

RE: How to set AWS IoT certificates in runtime

Susheel Nuguru — Fri, 16 Dec 2022 11:13:33 GMT

[quote user=""]And, Is there any plan for supporting AWS IoT Fleet Provisioning (Online Provisioning) in future nRFConnect SDK?[/quote]

WE do not talk about roadmaps and timelines here in devzone. Please ask your RSM about this. I have requested an RSM from your place to reach you out soon regarding this.

[quote user=""]How can I change device certificates for AWS IoT client in runtime?[/quote]

It does not look like we support this. For now it looks like static certificates only. I will let you know if the developers have anymore insight than this.