Using STMicroelectronics B-L475E-IOT01A Discovery kit to connect to IOT Hub but getting 0x00010085 Auth error.

Question

Using STMicroelectronics B-L475E-IOT01A Discovery kit to connect to IOT Hub but getting 0x00010085 Auth error.

West Coast John 20

I am following the Azure tutorial using the B-L475E-IOT01A Discovery kit to connect to IOT Hub via MQTT.

Tutorial: https://learn.microsoft.com/en-us/previous-versions/azure/iot/tutorial-devkit-stm-b-l475e-iot-hub

I pulled the example source from git and added my Azure Hub, device ID and primary SAS per the tutorial but when I run the example program I get an 0x00010085 error which indicates an authentication error, see Teraterm output below.

Initializing Azure IoT Hub client
        Hub hostname: xxxIotHub.azure-devices.net
        Device id: xxxdevice
        Model id: dtmi:azurertos:devkit:gsgstml4s5;2
ERROR: nx_azure_iot_hub_client_connect (0x00010085)

I have tried the following but still cannot connect:

Created a new Hub. (Free tier should work)
Tried different Wifi networks.
Updated the Wifi chip on the STMicro Discovery Kit.
Pulled the source code a 2nd time and rebuilt.

I am not sure how to debug this issue since I cannot get any additional information from Azure about why it is failing.

Any help would be appreciated.

Thanks...

Anshika Varshney 15,030 Reputation points Microsoft External Staff Moderator

2026-07-05T09:52:18.73+00:00

Hello @West Coast John

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Thankyou!
Anshika Varshney 15,030 Reputation points Microsoft External Staff Moderator

2026-07-07T18:17:25.4933333+00:00

Hello @West Coast John

Please let me know if the issue persists after these checks. If you have any remaining questions or need additional details, I’ll be glad to provide further clarification or guidance.

If the above steps resolve your issue, please mark this answer as Accepted so others can easily find the solution.

Thankyou!

Answer accepted by question author

Anshika Varshney 15,030 Microsoft External Staff Moderator

Hello @West Coast John ,

The error nx_azure_iot_hub_client_connect() returning 0x00010085 typically indicates an authentication or connection validation issue. Based on Azure IoT Hub connectivity guidance, I'd recommend reviewing the following areas:

Verify the device clock

SAS token authentication is time-sensitive. If the device clock is significantly out of sync with UTC, authentication can fail.
Ensure the device is successfully synchronizing time using SNTP/NTP and verify the RTC time after synchronization.

Validate device credentials

Confirm that you're using the device Primary Key (Base64 encoded) and not the device connection string.
Verify the IoT Hub hostname and Device ID exactly match the values configured in Azure IoT Hub.
If SAS tokens are generated on the device, validate the expiry time, resource URI, and HMAC-SHA256 signature generation.

Check device status in IoT Hub

In the Azure portal, navigate to IoT Hub > IoT Devices and confirm the device is enabled.
Verify that the device identity being used by the application exists and has not been disabled.

Review TLS configuration

Azure IoT Hub requires TLS 1.2.
Ensure the correct root CA certificates are present and that the TLS configuration supports the required cipher suites.

Test network connectivity

Verify that the device can reach the IoT Hub endpoint over port 8883 (MQTT) or the protocol being used.
If possible, test connectivity from another client on the same network to rule out firewall, proxy, or routing restrictions.

Enable SDK tracing

Enable detailed SDK logging to capture MQTT and TLS handshake information.
Additional traces can often identify whether the failure occurs during authentication, certificate validation, or network connection establishment.

Review IoT Hub networking settings

If IoT Hub is configured with IP filtering, private endpoints, or custom network restrictions, ensure the device network is allowed to connect.

Helpful references:

If you still face problems, share additional details and we’ll assist further.

If these steps resolve your issue, please mark this answer as Accepted so others can easily find the solution.

Thankyou!

West Coast John 20

@Anshika Varshney Thanks for your help. The problem turned out to be the TLSv1.2 cipher suite requirement imposed by Azure, see below. The sample code for the development kit is not configured to support TLSv1.2 cipher suites for Azure.

The most confusing part was figuring out which ciphers and suites that I needed to copy from sample files to the working file azure_iot_ciphersuites.c. Below are my changes to azure_iot_ciphersuites.c.

const NX_CRYPTO_METHOD* _nx_azure_iot_tls_supported_crypto[] = { 
    &crypto_method_hmac,
    &crypto_method_hmac_sha256,
    &crypto_method_tls_prf_sha256,
    &crypto_method_sha256,
    &crypto_method_aes_cbc_128,
    &crypto_method_rsa,
#ifdef NX_SECURE_ENABLE_ECC_CIPHERSUITE  // TLSv1.2: copied from nx_axure_iot_ciphersuites.c
    &crypto_method_ecdhe,
    &crypto_method_ecdsa,
    &crypto_method_ec_secp384,
#endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE */    
};


// Define supported TLS ciphersuites.
extern const NX_CRYPTO_CIPHERSUITE nx_crypto_tls_rsa_with_aes_128_cbc_sha256;
extern const NX_CRYPTO_CIPHERSUITE nx_crypto_x509_rsa_sha_256;
extern const NX_CRYPTO_CIPHERSUITE nx_crypto_tls_ecdhe_rsa_with_aes_128_gcm_sha256;     
extern const NX_CRYPTO_CIPHERSUITE nx_crypto_tls_ecdhe_ecdsa_with_aes_128_gcm_sha256;   
extern const NX_CRYPTO_CIPHERSUITE nx_crypto_tls_ecdhe_rsa_with_aes_128_cbc_sha256;     

const NX_CRYPTO_CIPHERSUITE* _nx_azure_iot_tls_ciphersuite_map[] = {
    // TLS ciphersuites.

//    &nx_crypto_tls_ecdhe_rsa_with_aes_128_gcm_sha256,       // Copied from nx_crypto_geneic_ciphersuites.c.  No NX_CRYPTO_ROLE_MAC_HASH so fails
    &nx_crypto_tls_ecdhe_rsa_with_aes_128_cbc_sha256,           // Copied from nx_crypto_geneic_ciphersuites.c
//    &nx_crypto_tls_ecdhe_ecdsa_with_aes_128_gcm_sha256,       // Copied from nx_crypto_geneic_ciphersuites.c.  No NX_CRYPTO_ROLE_MAC_HASH so fails

    // X.509 ciphersuites.
    &nx_crypto_x509_rsa_sha_256,
};


From https://learn.microsoft.com/en-us/azure/iot-hub/iot-hub-tls-support#cipher-suites
      To comply with Azure security policy for a secure connection, IoT Hub only supports the following RSA and ECDSA cipher suites:
        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256  (Implemented but broken)
        TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384  (Not supported)
        TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256  (Not supported)
        TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384  (Not suppored)
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256    (Implemented but broken)
        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384    (Not supported)
        TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256    (**** Works ****)
        TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384    (Not supported)

1 additional answer

Your answer

Anshika Varshney 15,030 Reputation points Microsoft External Staff Moderator

2026-07-05T09:52:18.73+00:00

Hello @West Coast John

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Thankyou!
Anshika Varshney 15,030 Reputation points Microsoft External Staff Moderator

2026-07-07T18:17:25.4933333+00:00

Hello @West Coast John

Please let me know if the issue persists after these checks. If you have any remaining questions or need additional details, I’ll be glad to provide further clarification or guidance.

If the above steps resolve your issue, please mark this answer as Accepted so others can easily find the solution.

Thankyou!

Answer 1

Error 0x00010085 on nx_azure_iot_hub_client_connect indicates an authentication/authorization failure from IoT Hub. Troubleshooting should focus on device identity, credentials, and connectivity.

Work through these checks in order:

Verify the device identity and connection string
- Confirm that the device ID used in firmware exactly matches a registered device in the IoT Hub.
- Use Azure CLI to validate the device identity and its key by sending a test message:
```
     az iot device simulate --device-id <your-device-id> --hub-name <your-iot-hub-name> --msg-count 1
```
  A successful send confirms that the device key/connection string is valid.
- If this fails, reset the device key and update the firmware with the new key:
```
     az iot hub device-identity update --device-id <your-device-id> --set authentication.symmetricKey.primaryKey="" --hub-name <your-iot-hub-name>
     az iot hub device-identity connection-string show --device-id <your-device-id> --hub-name <your-iot-hub-name>
```
Check SAS token validity (if generating SAS in code)
- 401xxx errors commonly occur if the SAS token is expired or malformed.
- Generate a known-good SAS token from CLI to compare with what the device uses:
```
     az iot hub generate-sas-token --device-id <your-device-id> --hub-name <your-iot-hub-name>
```
- Ensure the device’s token lifetime is in the future and the resource URI and key match the device identity in IoT Hub.
Confirm IoT Hub name and region
- 401001/401002 errors occur if the hub name or access is wrong.
- Verify the hostname in firmware (<hub-name>.azure-devices.net) exactly matches the IoT Hub instance where the device is registered.
Check device status in IoT Hub
- In the Azure portal, open the IoT Hub → Devices and ensure the device is present and Enabled. A disabled device will fail authentication.
Check protocol and port
- For MQTT, ensure outbound port 8883 is open from the network the board uses. If 8883 is blocked, MQTT over WebSockets (port 443) or another protocol is required.
- If using MQTT over WebSockets, ensure port 443 is open.
Use Azure Monitor logs to see the exact IoT Hub error
- Enable diagnostic settings on the IoT Hub to send Connections logs to a Log Analytics workspace.
- In the IoT Hub → Logs, run:
```
     AzureDiagnostics
     | where ( ResourceType == "IOTHUBS" and Category == "Connections" and Level == "Error")
```
- Look at ResultType and ResultDescription for the failed connection from this device. Common codes:
  - 401000 GenericUnauthorized – bad credentials.
  - 401003 IoTHubUnauthorized – token/certificate issue or device not found.
- Use the specific 401xxx description to refine the fix (for example, wrong key, wrong hub, missing permissions).
General 401xxx guidance
- Ensure:
  - SAS token is not expired.
  - Authorization credential is correctly formed for MQTT.
  - The device identity exists and the key matches.
  - The IoT Hub access policy used has permission for device operations.

If all above checks pass and the board still fails with 0x00010085, use the IoT SDK/device-side troubleshooting guidance for more detailed logs on the device, and compare the device’s connection attempt timestamps with the IoT Hub connection error entries in Azure Monitor.

References: