Provisioning AVR-IoT-Cellular Mini for Azure failed

[CsFreiber]

Dear Simen Gangstad and others,

I have tried to connect our AVR-IoT-Cellular Mini to our Azure IoT Hub with the mqtt_polling example, but with no success. I have made the following steps.
First I have created a root certificate (and sub certificate) with git and OpenSSL with the following Tutorial:
https://learn.microsoft.com/en-us/azure/iot-hub/tutorial-x509-test-certs?tabs=windows
At the step "Create a client certificate for a device" I have created the CSR out of the root (sub) CA with the help of the provisioning example and followed the equivalent steps in your tutorial:
https://iot.microchip.com/docs/arduino/userguide/custom_provisioning
with the variant: Provisioning against test.mosquitto.org with public-private key pairs and the ATECC chip.
However instead of using the test.mosquitto.org I used my own CA which I have created before and signed the CSR with git and OpenSSl like in the last step of:
https://learn.microsoft.com/en-us/azure/iot-hub/tutorial-x509-test-certs?tabs=windows

I have then tried to connect the AVR-IoT with both the root and sub CA in the Azure IoT Hub like in
https://learn.microsoft.com/en-us/azure/iot-hub/iot-hub-create-through-portal#register-a-new-device-in-the-iot-hub
with both as self signed certificate and CA signed.
But every variation and attempt failed to connect. The Error Code is:
[ERROR] Timed out whilst waiting for TLS signing. Please verify your certificate setup (run the provision Arduino sketch to set this up for a new broker

I have also tried the IoT provisioning tool from Microchip:
https://www.microchip.com/en-us/solutions/internet-of-things/iot-development-kits/iot-provisioning-tool
But when I wanted to provision the AVR-IoT for Azure the following error occured:

$ ./iotprovision-bin.exe -c azure
***** AVR-IoT, PIC-IoT and SAM-IoT provisioning utility 'iotprovision' *****
Start processing 'AVR-IoT Cellular Mini' kit for use with azure
ERROR - Operation failed with NotImplementedError: 'CellularProvisionerAzure' not yet implemented

Does this mean, there is not a provisioning for Azure possible yet? Or have I just missed something? If so, can you please provide an example how to provision the AVR-IoT-Cellular mini for the Azure IoT Hub?

Thank you and best regards
CsFreiber

[M65649]

Hello @CsFreiber,

We have a working Azure example with certificates that we’ve been testing internally, I just have to double check some details with a colleague on Monday. I’ll keep you updated.

[CsFreiber]

Hello @M65649 ,

this would be a great help, thank you!
best regards

CsFreiber

[M65649]

Hello again,

Sorry for the delay. Could you try to extract the ECC608 device certificate using the extract_certificates.ino example sketch and attempt an individual enrollment in Azure? The device identifier you specify has to be the same as the common name field of the device certificate.

This way to provision with the ECC is not something we have explicitly available with the provision.ino sketch, but one can circumvent this for now. Try to do a provision for MQTT with certificates and the ECC. The CA should be the Azure CA. When you are requested to input the certificate after the CSR, just paste in the device certificate (step 9 to 10). With this we're basically circumventing the whole CSR; We are just interested in placing the device certificate in the correct location, set up the CA and the corresponding security profile to use the ECC.

I'm attaching a sketch which you can use to test this setup. You need to fill out your Azure IoT Hub hostname and the common name field of the device certificate (it should be something alike snXXXXXXXXXXXXXXXXXX). We'll include a dedicated provision stage for Azure and this example sketch in the next release of the library.

Please feel free to ask more questions if something doesn't work as expected.

#include <Arduino.h>

#include <led_ctrl.h>
#include <log.h>
#include <lte.h>
#include <mqtt_client.h>

#define MQTT_PUB_TOPIC_FMT "devices/%s/messages/events/"
#define MQTT_SUB_TOPIC_FMT "%s/messages/devicebound/#"
#define DEVICE_ID          "<common name field from device certificate>"
#define IOT_HUB_HOST_NAME  "<azure iot hub host name>"
#define MQTT_USER_NAME \
    IOT_HUB_HOST_NAME "/" DEVICE_ID "/?api-version=2018-06-30"

char mqtt_sub_topic[128];
char mqtt_pub_topic[128];

void setup() {
    Log.begin(115200);

    LedCtrl.begin();
    LedCtrl.startupCycle();

    Log.info("Starting initialization of MQTT Polling for Azure\r\n");

    // Set up topics
    sprintf(mqtt_sub_topic, MQTT_SUB_TOPIC_FMT, DEVICE_ID);
    sprintf(mqtt_pub_topic, MQTT_PUB_TOPIC_FMT, DEVICE_ID);

    if (!Lte.begin()) {
        Log.error("Failed to connect to operator");

        // Halt here if we fail
        while (1) {}
    }

    // Attempt to connect to the broker. The device ID is here the common name
    // field of the device certificate.
    if (MqttClient.begin(DEVICE_ID,
                         IOT_HUB_HOST_NAME,
                         8883,
                         true,
                         60,
                         true,
                         MQTT_USER_NAME)) {

        Log.infof("Connecting to broker");

        while (!MqttClient.isConnected()) {
            Log.rawf(".");
            delay(500);
        }

        Log.rawf(" OK!\r\n");

        // Subscribe to the topic
        MqttClient.subscribe(mqtt_sub_topic);
    } else {
        Log.rawf("\r\n");
        Log.error("Failed to connect to broker");

        // Halt here
        while (1) {}
    }
}

void loop() {

    bool published_successfully =
        MqttClient.publish(mqtt_pub_topic, "{\"light\": 9, \"temp\": 9}");

    Log.infof("Publishing: %s\r\n", mqtt_pub_topic);

    if (published_successfully) {
        Log.info("Published message");
    } else {
        Log.error("Failed to publish\r\n");
    }

    delay(2000);

    String message = MqttClient.readMessage(mqtt_sub_topic);

    // Read message will return an empty string if there were no new
    // messages, so anything other than that means that there were a
    // new message
    if (message != "") {
        Log.infof("Got new message: %s\r\n", message.c_str());
    }

    delay(2000);
}

Best,
Simen

[CsFreiber]

Hello Simen,

First of all thank you very much for your answers and the support! Don't worry about responding after few days, this is alrigth.
I have done the steps you suggested. I made an individuall enrollment and the provisioning as you said, with the DigiCertGlobalRootG2 CA and I tryed also the BaltimoreCyberTrustRoot CA (We two Hubs which have one of these root CA). However with no success. I have even tryed adding a device in the IoT Hub (of course with the device id as device name, it is has the form as you said snXXXXXXXXXXXXXXXXXX) and adding the device certificate as a .PEM file, which I extracted from the extract_certificates.ino example sketch to the Hub. There I tryed with every authentication type, but this hasn't worked either. The AVR-IoT-Cellular mini doesn't connect to our Azure broker and I become everytime the same error code as above.

I am going to troubleshoot the proccess again with my collegue but maybe you can also give some tipps. What could I try or where should I take attentions? Maybe someone had also this problem, but managed to solve it?
Thank you for your help and support!

Best regards

CsFreiber

[M65649]

Hello @CsFreiber,

I realise I misunderstood my colleague a bit. I've been out of the country and have not had a device to test with me. Individual enrollment is not necessary. You simply need to create a device in IoT Hub and use the sha256 sum of the device certificate. With the following steps I'm able to connect to Azure IoT Hub.

1. Create a new device in IoT Hub
   • Use CN from device certificate as device ID.
   • Select X.509 Self-Signed.
   • Generate sha256 thumbprint from device certificate and use it as primary and secondary thumbprint: openssl x509 -in device.pem -outform der | sha256sum.
   • Should look something like this:

2. Flash the provision sketch and follow the same process as before with MQTT ECC public-private key pair provisioning

   • Use TLS v1.2.
   • Leave the ciphers blank.
   • I used the new DigiCertGlobalRootG2 CA (remember to convert your IoT Hub to use this or use the old CA).
   • Select to use ECC and paste in the device certificate extracted from the board after the CSR process (as before the whole CSR is omitted with this, we're just interested in placing the device certificate in the correct slot for the modem).

3. I tested with the sketch above monitoring in azure with az iot hub monitor-events -n <my iot hub name> to see that the messages arrived with the following parameters

   • DEVICE_ID set to the same CN as in the device certificate.
   • IOT_HUB_HOST_NAME set to <my iot hub name>.azure-devices.net.

Please let me know if this works for you. Happy to help if there are any other issues.

Best,
Simen

[CsFreiber]

Dear Simen,

thank you so much for your support! It was a big help! I have finally connected our device to our Azure IoT Hub. This step by step instruction is now working immediately.
Here are some (obviously) helpfull tipps for other users:

1. Make sure you use the correct Azure CA which is assigned to your IoT Hub, when you provision your device.
2. When you paste the certificates (like CA or device certificate), make sure you are using the Serial Monitor only with new line as ending. For all other commands use the carriage return option. This is necessary in order to read the certificate correctly.
3. I have also added the device certificate to the IoT Hub under security settings/certificates as a PEM file, with the same name as the Device ID
4. If you have flashed with the example above Provisioning AVR-IoT-Cellular Mini for Azure failed #16 (comment) the monitoring message from the IoT Hub should look like this in VSCode

[IoTHubMonitor] [2:08:26 PM] Message received from [snXXXXXXXXXXXXXXXXXX]:
{
"light": 9,
"temp": 9
}

best regards

CsFreiber

[M65649]

That's great! The next release will include dedicated Azure provisioning through this method. Feel free to let me know if there are any other issues/functionality you need.

Best,
Simen