samples: net: Unify certificate handling

Update NET samples to be able to import and use certificates
in valid PEM format.

Signed-off-by: Simen S. Røstad <[email protected]>

Author: simensrostad

applications/asset_tracker_v2/CMakeLists.txt

@@ -30,16 +30,19 @@ add_subdirectory_ifdef(CONFIG_WATCHDOG_APPLICATION src/watchdog)
 # Include nRF modem library header file for PC builds.
 # These are used throughout the application in type definitions.
 if (CONFIG_BOARD_QEMU_X86 OR CONFIG_BOARD_NATIVE_POSIX)
-        target_include_directories(app PRIVATE ${NRFXLIB_DIR}/nrf_modem/include/)
+	target_include_directories(app PRIVATE ${NRFXLIB_DIR}/nrf_modem/include/)
 
-        # Make folder containing certificates global so that it can be located by the configured
-        # cloud library.
-        zephyr_include_directories(src/cloud-certs)
+	# Make the folder that contains the certificates global so that it can be located by the
+	# nRF Cloud library. For the other clouds integrations, the certificates are handled by the
+	# MQTT helper library, see CONFIG_MQTT_HELPER_PROVISION_CERTIFICATES.
+	if (CONFIG_NRF_CLOUD_PROVISION_CERTIFICATES)
+		zephyr_include_directories(src/cloud-certs)
+	endif()
 
-        target_compile_options(app PRIVATE
-	        -DCONFIG_LTE_NEIGHBOR_CELLS_MAX=10)
+	target_compile_options(app PRIVATE
+		-DCONFIG_LTE_NEIGHBOR_CELLS_MAX=10)
 endif()
 
 if(CONFIG_ASSET_TRACKER_V2_LTO)
-        target_compile_options(app PRIVATE "-flto")
+	target_compile_options(app PRIVATE "-flto")
 endif()

applications/asset_tracker_v2/boards/native_sim.conf

@@ -116,3 +116,6 @@ CONFIG_BUILD_S1_VARIANT=n
 
 # Watchdog
 CONFIG_WATCHDOG_APPLICATION=n
+
+# Cloud module certificates
+CONFIG_MQTT_HELPER_CERTIFICATES_FOLDER="src/cloud-certs"

applications/asset_tracker_v2/src/cloud-certs/ca-cert.pem

@@ -188,9 +188,9 @@ There are multiple ways to generate and register these certificates:
 
       #. Take note of the certificate ARN, as it will be required later.
       #. Download the `Amazon Root CA 1`_ PEM file as :file:`ca-cert.pem`.
-      #. Provision the certificates and private key at runtime to the Mbed TLS stack.
-         This is achieved by placing the PEM files into a :file:`certs/` subdirectory and ensuring the :kconfig:option:`CONFIG_MQTT_HELPER_PROVISION_CERTIFICATES` Kconfig option is enabled.
-         For more information, refer to the :ref:`aws_iot` sample as well as the :kconfig:option:`CONFIG_MQTT_HELPER_CERTIFICATES_FILE` Kconfig option.
+      #. Place the PEM files into the folder path specified by the :kconfig:option:`CONFIG_MQTT_HELPER_CERTIFICATES_FOLDER` option, default is :file:`<app_src_dir>/certs/`.
+         Ensure that the :kconfig:option:`CONFIG_MQTT_HELPER_PROVISION_CERTIFICATES` option is set.
+      #. If the files are placed correctly, the :ref:`lib_mqtt_helper` library finds the certificates and provisions them to the Mbed TLS stack when connecting to AWS IoT.
 
 .. rst-class:: numbered-step
 

applications/asset_tracker_v2/src/cloud-certs/client-cert.pem

@@ -342,14 +342,6 @@ The following are the ways to generate and register device certificates:
 
       #. Provision the certificates and private key at runtime to the Mbed TLS stack.
          This is achieved by placing the PEM files into a :file:`certs/` subdirectory and ensuring the :kconfig:option:`CONFIG_MQTT_HELPER_PROVISION_CERTIFICATES` Kconfig option is enabled.
-         The PEM files need to be converted to string format to be compiled into the firmware.
-
-         To do this, enclose each line in the PEM file with double quotes and finish each line with a newline character, using the following command:
-
-         .. code-block:: console
-
-            sed -i'.org' 's/.*/"&\\n"/' <pem_file>
-
          For more information, refer to the :ref:`azure_iot_hub` sample as well as the :kconfig:option:`CONFIG_MQTT_HELPER_CERTIFICATES_FILE` Kconfig option.
 
 .. rst-class:: numbered-step

applications/asset_tracker_v2/src/cloud-certs/private-key.pem

@@ -27,7 +27,7 @@ Additionally, configure the following options as per the needs of your applicati
 * :kconfig:option:`CONFIG_MQTT_HELPER_RX_TX_BUFFER_SIZE`
 * :kconfig:option:`CONFIG_MQTT_HELPER_PAYLOAD_BUFFER_LEN`
 * :kconfig:option:`CONFIG_MQTT_HELPER_PROVISION_CERTIFICATES`
-* :kconfig:option:`CONFIG_MQTT_HELPER_CERTIFICATES_FILE`
+* :kconfig:option:`CONFIG_MQTT_HELPER_CERTIFICATES_FOLDER`
 
 API documentation
 *****************

doc/nrf/libraries/networking/aws_iot.rst

@@ -31,7 +31,16 @@ Samples and applications
 
 This section describes the changes related to samples and applications.
 
-|no_changes_yet_note|
+* For applications using the :ref:`lib_mqtt_helper` library:
+
+  * The ``CONFIG_MQTT_HELPER_CERTIFICATES_FILE`` is now replaced by :kconfig:option:`CONFIG_MQTT_HELPER_CERTIFICATES_FOLDER`.
+    The new option is a folder path where the certificates are stored.
+    The folder path must be relative to the root of the project.
+
+    If you are using the :ref:`lib_mqtt_helper` library, you must update the Kconfig option to use the new option.
+
+  * When using the :kconfig:option:`CONFIG_MQTT_HELPER_PROVISION_CERTIFICATES` Kconfig option, the certificate files must be in standard PEM format.
+    This means that the PEM files must not be converted to string format anymore.
 
 Libraries
 =========

doc/nrf/libraries/networking/azure_iot_hub.rst

@@ -243,7 +243,9 @@ Multicore samples
 Networking samples
 ------------------
 
-|no_changes_yet_note|
+* Updated:
+
+  *  The networking samples to support import of certificates in valid PEM formats.
 
 NFC samples
 -----------
@@ -356,6 +358,11 @@ Libraries for networking
     * The :kconfig:option:`CONFIG_NRF_CLOUD_LOCATION_ANCHOR_LIST` Kconfig option to enable including Wi-Fi anchor names in the location callback.
     * The :kconfig:option:`CONFIG_NRF_CLOUD_LOCATION_ANCHOR_LIST_BUFFER_SIZE` Kconfig option to control the buffer size used for the anchor names.
 
+* :ref:`lib_mqtt_helper` library:
+
+  * Changed the library to read certificates as standard PEM format. Previously the certificates had to be manually converted to string format before compiling the application.
+  * Replaced the ``CONFIG_MQTT_HELPER_CERTIFICATES_FILE`` Kconfig option with :kconfig:option:`CONFIG_MQTT_HELPER_CERTIFICATES_FOLDER`. The new option specifies the folder where the certificates are stored.
+
 Libraries for NFC
 -----------------