On-device generation of the nRF Cloud device private key and a Certificate Signing Request (CSR). More...

Functions
int	nrf_cloud_credentials_key_generate (uint32_t sec_tag)
	Generate the device private key on-device for the given sec tag.

int	nrf_cloud_credentials_key_delete (uint32_t sec_tag)
	Delete the on-device device private key for the given sec tag.

int	nrf_cloud_credentials_csr_generate (uint32_t sec_tag, const char subject, uint8_t out, size_t out_size, size_t *out_len)
	Generate a Certificate Signing Request (CSR) for the device key.

int	nrf_cloud_credentials_pubkey_get (uint32_t sec_tag, uint8_t out, size_t out_size, size_t out_len)
	Export the public key of the on-device key pair.

Detailed Description

On-device generation of the nRF Cloud device private key and a Certificate Signing Request (CSR).

The key is generated with the PSA Crypto API as a persistent, non-exportable ECC P-256 key and is referenced for TLS by its PSA key id, so the private key never leaves the device. These functions allow an application to drive the key generation and CSR extraction directly (for example to onboard a device over BLE, NFC, or another transport), instead of using the shell commands.

This API is available when

CONFIG_NRF_CLOUD_CREDENTIALS_KEYGEN

is enabled.

Note: Only a single on-device key sec tag can be registered at a time. The nRF Cloud library uses one device key sec tag, and the opaque-key registration relies on a single backing slot, so generating or restoring a key for a second sec tag while another is registered is rejected. Delete the existing key first to switch to a different sec tag.

Functions

Detailed Description