Solution for generating new private keys when modem firmware 1.3.1 cannot be used.

[JVantol]

Does Nordic have a suggested solution for what to do with B0A level devices which cannot run modem firmware 1.3.1 in production? We've got a nice solution using AT%KEYGEN for version 2 hardware, but we've got deployed version 1 devices out in the wild that will soon need a certificate replacement.

Does Nordic have an application side recommended replacement for the AT%KEYGEN functionality that the newer devices with modem firmware 1.3.1 and newer support? Is there an example showing how to to do this? I assume that it can be done by using MBEDTLS, but the setup and use of it is quite intimidating.

Any suggestions you could provide would be very helpful.

[Hakon]

Hello,

I will check this with the modem team.

[JVantol]

It looks like there is a crypto example for generating an RSA private/public key pair:

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/2.2.0/nrf/samples/crypto/rsa/README.html

I think that you could use this to generate the private key, and they generate a CSR from the public key, but I'm not enough of an expert to know exactly how this might be done. Is this correct that you could use the PSA crypto library to make the required key pair? If so, can you suggest a library that can generate a CSR from the public key?