IoT Hub / DPS server certificate chain size: will it stay under 4 KB for constrained devices?

Max Haynes 0 Reputation points
2026-10-15T08:12:58.0666667+00:00

We run cellular sensors on the Nordic nRF9160. They connect over MQTT (port 8883) to Azure IoT Hub and provision through DPS, using X.509 device authentication. The TLS handshake runs inside the modem, and the modem only accepts a server certificate chain of at most 4 KB. This hardware limit cannot be changed in the field. If a chain grows beyond it, devices lose their connection and cannot be updated over the air.

This already happened with App Service. Since August 2026, *.azurewebsites.net serves a chain through Microsoft TLS G2 RSA CA OCSP → Microsoft TLS RSA Root G2 (cross-signed) → DigiCert Global Root G2, about 6.8 KB.

Current IoT Hub chains (measured 2026-10-15):

  • RSA (default): leaf → MSFT RS256 CA-1 → DigiCert Global Root G2, about 3.0 KB
  • ECC (ECDHE-ECDSA suites only): leaf → Microsoft TLS G2 ECC CA OCSP 06 → Microsoft TLS ECC Root G2 (cross-signed by DigiCert Global Root G3), about 3.6 KB
  • DPS: RSA only. An ECDSA-only handshake fails.

Questions:

  1. Is IoT Hub / DPS planned to move to the Microsoft TLS G2 RSA hierarchy (like App Service)? If so, when?
  2. Will the IoT Hub ECC chain remain below 4 KB? Is the cross-signed root always included?
  3. Is an ECC server certificate planned for DPS?
  4. How much notice is given before the issuing CA or the chain structure changes, and where is it announced?
  5. Is there a supported option for constrained devices to get a stable or bounded chain (for example a custom server certificate or domain)?
Azure IoT Hub
Azure IoT Hub

An Azure service that enables bidirectional communication between internet of things (IoT) devices and applications.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. kagiyama yutaka 5,655 Reputation points
    2026-10-26T12:58:52.3233333+00:00

    I think the hard 4 KB limit is the real problem here. Those 3.0/3.6 KB chains are just what u measured, not a guarantee they'll stay that small. IoT Hub/DPS don't document a maximum chain size, fixed ECC chain, or cross-signed root behavior. No published dates for G2 RSA migration or DPS ECC either.

    TLS fragmentation won't make the chain smaller, and there's no documented option to use ur own server certificate. Leaf/intermediate certs can change with little or no notice.

    Since a larger chain could also kill OTA recovery, send Azure support the IoT Hub/DPS TLS captures, cipher suites, and nRF9160 modem firmware version. Ask whether any configuration can stay under 4 KB, what's planned, and how changes will be announced.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.