nRF Connect for Cloud Certificate Update

This guide shows you how to generate and provision new nRF Connect for Cloud certificates for your Nordic Thingy:91 or nRF9160 development kit (DK).


  1. To generate new nRF Connect for Cloud certificates you need to have a nRF Connect for Cloud account.
  2. For provisioning the certificates onto your device you need the nRF Connect for Desktop LTE Link Monitor application v1.1.1 or later. Download here.
  3. Make sure the Thingy:91 or nRF9160 DK has an application firmware that supports long AT commands up to 3kB.

    Pre-compiled application firmware (v0.2.3 and later) for Thingy:91 with this support can be found under the Thingy:91 download page. The latest pre-compiled application firmware for the nRF9160 DK also has this support. Both downloads (Thingy:91 or nRF9160 DK) have nRF9160 SiP application firmware for connecting to an LTE-M or NB-IoT network. The ZIP file inside the download is the modem firmware (, do not unzip. The modem firmware will be updated in the next step.

    Follow these steps to update the Thingy:91 with the appropriate hex file (see CONTENTS.txt in the download for description). Follow these steps to update the nRF9160 DK with the appropriate hex file (see CONTENTS.txt in the download for description).

  4. Update your modem firmware ( Follow this link to update the Thingy:91 or this link to update the nRF9160 DK modem firmware.
(Note: If you want to compile an application with long AT commands up to 3 kB enabled, you can add CONFIG_AT_CMD_RESPONSE_MAX_LEN 3000 to the application's prj.conf file)

Download new certificates

To download new certificates go into the account view in the top right corner of nRF Connect for Cloud. Then input the device ID in the format nrf-<IMEI> and PIN/HWID found on the label on the PCB into the Device Certificates card. PIN for Thingy:91 and HWID (with or without colons) for nRF9160 DK.

Then click the Download Certificate button.

Provision certificates

  1. Open nRF Connect for Desktop, launch LTE Link Monitor application and connect to the device using USB.
  2. Remove the SIM card and ensure the modem is in offline state (AT+CFUN=4) before updating certificates. Uncheck Automatic requests and use AT+CFUN? to read the state.
  3. Go to the Certificate manager tab either by clicking the button on the top or by using the shortcut Alt+3.
  4. Import the downloaded JSON file either by dragging and dropping it into the GUI or by clicking the Load from JSON button.
  5. Ensure Security tag is set to 16842753. Then provision the certificates by clicking the Update certificates button and observe that all the AT commands get the OK response.

Delete device

The device must first be deleted from nRF Connect for Cloud before the new certificates will work. 

Go into the account view on nRF Cloud. Then input the device ID in the format nrf-<IMEI> and PIN/HWID found on the label on the PCB into the Reset a Device card. PIN for Thingy:91 and HWID (with or without colons) for nRF9160 DK.

Then click the Reset Device button.


  • Remember to re-flash the asset tracker application, if the at_client was flashed and used for provisioning.
  • POLLHUP is expected the very first time the device connects after the above procedure has been completed. If the application does not automatically restart, do a manual restart of the device by toggling power (Thingy:91) or pressing the reset button (nRF9160 DK).
  • Since the above steps deletes your device it needs to be re-added to your account after the above steps are completed.
  • If updating certificates on a nRF9160 DK without PIN, its important to remember that after running through the above steps the kit should be added to nRF Connect for Cloud using the IMEI and PIN/HWID method, not the legacy button and switch method.

If you have any questions related to this, please create a DevZone ticket here. Please do not use the comment section below.

  • I have an early nrf9160 (PCA10090 v 0.8.2).

    I have updated the modem fw to the newest.

    I have updated the certificate without problems.
    I have built (via Segger) and installed the newest release version of the asset_tracker onto the board.

    I register the SIM via nrfCloud, install the SIM, and turn on the device.

    Now after 11 minutes, it still doesn't connect to the network (LTE).
    Finally after around 13 minutes, this is output to the log, and the LTE icon turns solid gray (in the LTE Link Monitor app):
    %CESQ: 29,1,17,2
    +CEREG: 2,"26AC","00B14F8C",9
    [00:12:09.635,650] [0m lte_lc.parse_nw_reg_status: Network registration status: 2 [0m
    +CNEC_EMM: 15
    [00:12:09.925,964] [1;31m lte_lc: Could not parse AT+CEREG response, error: -11
    [0m[00:12:09.934,051] [1;31m lte_lc: Could not get network registration status[0m
    +CEREG: 4,"26AC","00B14F8C",9
    [00:12:09.944,763] [0m lte_lc.parse_nw_reg_status: Network registration status: 4[0m
    %CESQ: 255,0,255,0
    [00:12:09.993,286] [0m lte_lc.parse_nw_reg_status: Network registration status: 4[0m

    Then after a bit longer, the LTE stays gray, but the signal strength indicator shows 3 out of 4, while the Current Band shows N/A.

    The Chart shows some activity too. A green line appears showing reference signal power. But at the same time an event (in the chart) says "No suitable cells in tracking area".

    I'm living in Denmark, where the iBasis website says there's national coverage.

    What's going on? Thanks in advance.

Comment Children