From ae1a788b18c6a55c3ad0c5affbcf3d95d43ff9f8 Mon Sep 17 00:00:00 2001
From: arduino <info@arduino.cc>
Date: Thu, 9 Jan 2025 08:31:01 +0100
Subject: [PATCH 01/10] Add weak variable checking for device certificate
 update

---
 src/ArduinoIoTCloudTCP.cpp | 94 ++++++++++++++++++++++++++++++--------
 src/ArduinoIoTCloudTCP.h   | 26 +++++++----
 2 files changed, 90 insertions(+), 30 deletions(-)

diff --git a/src/ArduinoIoTCloudTCP.cpp b/src/ArduinoIoTCloudTCP.cpp
index 121e26326..4e85e344d 100644
--- a/src/ArduinoIoTCloudTCP.cpp
+++ b/src/ArduinoIoTCloudTCP.cpp
@@ -43,6 +43,13 @@ unsigned long getTime()
   return ArduinoCloud.getInternalTime();
 }
 
+char NOT_AFTER[]        __attribute__((weak)) = "";
+char NOT_BEFORE[]       __attribute__((weak)) = "";
+char SERIAL_NUMBER[]    __attribute__((weak)) = "";
+char AUTHORITY_KEY_ID[] __attribute__((weak)) = "";
+char SIGNATURE[]        __attribute__((weak)) = "";
+
+
 /******************************************************************************
    CTOR/DTOR
  ******************************************************************************/
@@ -59,6 +66,9 @@ ArduinoIoTCloudTCP::ArduinoIoTCloudTCP()
 #ifdef BOARD_HAS_SECRET_KEY
 , _password("")
 #endif
+#if defined(BOARD_HAS_SECURE_ELEMENT)
+, _writeOnConnect(false)
+#endif
 , _mqttClient{nullptr}
 , _messageTopicOut("")
 , _messageTopicIn("")
@@ -80,11 +90,6 @@ int ArduinoIoTCloudTCP::begin(ConnectionHandler & connection, bool const enable_
 {
   _connection = &connection;
   _brokerAddress = brokerAddress;
-#ifdef BOARD_HAS_SECRET_KEY
-  _brokerPort = _password.length() ? DEFAULT_BROKER_PORT_USER_PASS_AUTH : brokerPort;
-#else
-  _brokerPort = brokerPort;
-#endif
 
   /* Setup broker TLS client */
   _brokerClient.begin(connection);
@@ -94,20 +99,7 @@ int ArduinoIoTCloudTCP::begin(ConnectionHandler & connection, bool const enable_
   _otaClient.begin(connection);
 #endif
 
-  /* Setup TimeService */
-  _time_service.begin(_connection);
-
-  /* Setup retry timers */
-  _connection_attempt.begin(AIOT_CONFIG_RECONNECTION_RETRY_DELAY_ms, AIOT_CONFIG_MAX_RECONNECTION_RETRY_DELAY_ms);
-  return begin(enable_watchdog, _brokerAddress, _brokerPort);
-}
-
-int ArduinoIoTCloudTCP::begin(bool const enable_watchdog, String brokerAddress, uint16_t brokerPort)
-{
-  _brokerAddress = brokerAddress;
-  _brokerPort = brokerPort;
-
-#if defined(BOARD_HAS_SECRET_KEY)
+#if defined (BOARD_HAS_SECRET_KEY)
   /* If board is not configured for username and password login */
   if(!_password.length())
   {
@@ -129,23 +121,63 @@ int ArduinoIoTCloudTCP::begin(bool const enable_watchdog, String brokerAddress,
       DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device id.", __FUNCTION__);
       return 0;
     }
-  #if !defined(BOARD_HAS_OFFLOADED_ECCX08)
+    /* read certificate stored in secure element to compare AUTHORITY_KEY_ID */
     if (!SElementArduinoCloudCertificate::read(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
     {
       DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device certificate.", __FUNCTION__);
       return 0;
     }
+    /* check if we need to update and try rebuild */
+    int result = SElementArduinoCloudCertificate::update(_selement, _cert, getDeviceId(), String(NOT_BEFORE), String(NOT_AFTER), String(SERIAL_NUMBER), String(AUTHORITY_KEY_ID), String(SIGNATURE));
+    if (result > 0)
+    {
+      DEBUG_INFO("ArduinoIoTCloudTCP::%s device certificate update request.", __FUNCTION__);
+      _writeOnConnect = true;
+    }
+    else if (result < 0)
+    {
+      DEBUG_ERROR("ArduinoIoTCloudTCP::%s device certificate rebuild error.", __FUNCTION__);
+      /* there was an error trying to rebuild certificate re-read old one */
+      if (!SElementArduinoCloudCertificate::read(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
+      {
+        DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device id.", __FUNCTION__);
+        return 0;
+      }
+    }
+    else
+    {
+      DEBUG_VERBOSE("ArduinoIoTCloudTCP::%s device certificate updated.", __FUNCTION__);
+    }
+  #if !defined(BOARD_HAS_OFFLOADED_ECCX08)
     _brokerClient.setEccSlot(static_cast<int>(SElementArduinoCloudSlot::Key), _cert.bytes(), _cert.length());
     #if  OTA_ENABLED
     _otaClient.setEccSlot(static_cast<int>(SElementArduinoCloudSlot::Key), _cert.bytes(), _cert.length());
     #endif
   #endif
+    _brokerPort = (brokerPort == DEFAULT_BROKER_PORT_AUTO) ? mqttPort() : brokerPort;
 #endif
 
 #if defined(BOARD_HAS_SECRET_KEY)
   }
+  else
+  {
+    _brokerPort = (brokerPort == DEFAULT_BROKER_PORT_AUTO) ? DEFAULT_BROKER_PORT_USER_PASS_AUTH : brokerPort;
+  }
 #endif
 
+  /* Setup TimeService */
+  _time_service.begin(_connection);
+
+  /* Setup retry timers */
+  _connection_attempt.begin(AIOT_CONFIG_RECONNECTION_RETRY_DELAY_ms, AIOT_CONFIG_MAX_RECONNECTION_RETRY_DELAY_ms);
+  return begin(enable_watchdog, _brokerAddress, _brokerPort);
+}
+
+int ArduinoIoTCloudTCP::begin(bool const enable_watchdog, String brokerAddress, uint16_t brokerPort)
+{
+  _brokerAddress = brokerAddress;
+  _brokerPort = brokerPort;
+
   _mqttClient.setClient(_brokerClient);
 
 #ifdef BOARD_HAS_SECRET_KEY
@@ -281,6 +313,17 @@ ArduinoIoTCloudTCP::State ArduinoIoTCloudTCP::handle_ConnectMqttBroker()
     /* Subscribe to message topic to receive commands */
     _mqttClient.subscribe(_messageTopicIn);
 
+#if defined(BOARD_HAS_SECURE_ELEMENT)
+    /* A device certificate update was pending */
+    if (_writeOnConnect)
+    {
+      if (SElementArduinoCloudCertificate::write(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
+      {
+        DEBUG_INFO("ArduinoIoTCloudTCP::%s device certificate update done.", __FUNCTION__);
+        _writeOnConnect = false;
+      }
+    }
+#endif
     DEBUG_VERBOSE("ArduinoIoTCloudTCP::%s connected to %s:%d", __FUNCTION__, _brokerAddress.c_str(), _brokerPort);
     return State::Connected;
   }
@@ -558,6 +601,17 @@ int ArduinoIoTCloudTCP::write(String const topic, byte const data[], int const l
   return 0;
 }
 
+#if defined(BOARD_HAS_SECURE_ELEMENT)
+int ArduinoIoTCloudTCP::mqttPort()
+{
+  if (memcmp(DEPRECATED_BROKER_AUTHORITY_KEY_IDENTIFIER, _cert.authorityKeyIdentifierBytes() , ECP256_CERT_AUTHORITY_KEY_ID_LENGTH) == 0) {
+    return DEPRECATED_BROKER_PORT_SECURE_AUTH;
+  } else {
+    return DEFAULT_BROKER_PORT_SECURE_AUTH;
+  }
+}
+#endif
+
 /******************************************************************************
  * EXTERN DEFINITION
  ******************************************************************************/
diff --git a/src/ArduinoIoTCloudTCP.h b/src/ArduinoIoTCloudTCP.h
index f1682164d..d30551f76 100644
--- a/src/ArduinoIoTCloudTCP.h
+++ b/src/ArduinoIoTCloudTCP.h
@@ -31,16 +31,14 @@
 #if defined(BOARD_HAS_SECURE_ELEMENT)
   #include <Arduino_SecureElement.h>
   #include <utility/SElementArduinoCloudDeviceId.h>
-  #if !defined(BOARD_HAS_OFFLOADED_ECCX08)
-    #include <utility/SElementArduinoCloudCertificate.h>
-  #endif
+  #include <utility/SElementArduinoCloudCertificate.h>
 #endif
 
 #include <tls/utility/TLSClientMqtt.h>
 #include <tls/utility/TLSClientOta.h>
 
 #if OTA_ENABLED
-#include <ota/OTA.h>
+  #include <ota/OTA.h>
 #endif
 
 #include "cbor/MessageDecoder.h"
@@ -49,9 +47,14 @@
 /******************************************************************************
    CONSTANTS
  ******************************************************************************/
-static char const DEFAULT_BROKER_ADDRESS_SECURE_AUTH[] = "iot.arduino.cc";
-static uint16_t const DEFAULT_BROKER_PORT_SECURE_AUTH = 8883;
+static char const DEFAULT_BROKER_ADDRESS[] = "iot.arduino.cc";
+static uint16_t const DEFAULT_BROKER_PORT_SECURE_AUTH = 8885;
+static uint16_t const DEPRECATED_BROKER_PORT_SECURE_AUTH = 8883;
+static uint8_t const DEPRECATED_BROKER_AUTHORITY_KEY_IDENTIFIER[] = {
+                  0x5b, 0x3e, 0x2a, 0x6b, 0x8e, 0xc9, 0xb0, 0x1a, 0xa8, 0x54,
+                  0xe6, 0x36, 0x9b, 0x8c, 0x09, 0xf9, 0xfc, 0xe1, 0xb9, 0x80 };
 static uint16_t const DEFAULT_BROKER_PORT_USER_PASS_AUTH = 8884;
+static uint16_t const DEFAULT_BROKER_PORT_AUTO = 0;
 
 /******************************************************************************
  * TYPEDEF
@@ -74,8 +77,8 @@ class ArduinoIoTCloudTCP: public ArduinoIoTCloudClass
     virtual int  connected     () override;
     virtual void printDebugInfo() override;
 
-    int begin(ConnectionHandler & connection, bool const enable_watchdog = true, String brokerAddress = DEFAULT_BROKER_ADDRESS_SECURE_AUTH, uint16_t brokerPort = DEFAULT_BROKER_PORT_SECURE_AUTH);
-    int begin(bool const enable_watchdog = true, String brokerAddress = DEFAULT_BROKER_ADDRESS_SECURE_AUTH, uint16_t brokerPort = DEFAULT_BROKER_PORT_SECURE_AUTH);
+    int begin(ConnectionHandler & connection, bool const enable_watchdog = true, String brokerAddress = DEFAULT_BROKER_ADDRESS, uint16_t brokerPort = DEFAULT_BROKER_PORT_AUTO);
+    int begin(bool const enable_watchdog = true, String brokerAddress = DEFAULT_BROKER_ADDRESS, uint16_t brokerPort = DEFAULT_BROKER_PORT_AUTO);
 
     #ifdef BOARD_HAS_SECRET_KEY
     inline void setBoardId        (String const device_id) { setDeviceId(device_id); }
@@ -142,9 +145,8 @@ class ArduinoIoTCloudTCP: public ArduinoIoTCloudClass
 
 #if defined(BOARD_HAS_SECURE_ELEMENT)
     SecureElement _selement;
-  #if !defined(BOARD_HAS_OFFLOADED_ECCX08)
     ECP256Certificate _cert;
-  #endif
+    bool _writeOnConnect;
 #endif
 
     TLSClientMqtt _brokerClient;
@@ -183,6 +185,10 @@ class ArduinoIoTCloudTCP: public ArduinoIoTCloudClass
     void detachThing();
     int write(String const topic, byte const data[], int const length);
 
+#if defined(BOARD_HAS_SECURE_ELEMENT)
+    int mqttPort();
+#endif
+
 };
 
 /******************************************************************************

From d5cc0e06919da2fc17f120ee1e3c2d9cb65a5df2 Mon Sep 17 00:00:00 2001
From: arduino <info@arduino.cc>
Date: Fri, 10 Jan 2025 12:51:04 +0100
Subject: [PATCH 02/10] Update BearSSL Trust Anchors

---
 src/tls/BearSSLTrustAnchors.h | 70 ++++++++++++++++++++++++++++++++++-
 1 file changed, 68 insertions(+), 2 deletions(-)

diff --git a/src/tls/BearSSLTrustAnchors.h b/src/tls/BearSSLTrustAnchors.h
index 3646b6e8f..6cd87e818 100644
--- a/src/tls/BearSSLTrustAnchors.h
+++ b/src/tls/BearSSLTrustAnchors.h
@@ -37,6 +37,8 @@
 //
 //   brssl ta *.cer
 
+//iot.arduino.cc:8883
+//iot.oniudra.cc:8883
 static const unsigned char TA0_DN[] = {
   0x30, 0x45, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
   0x02, 0x55, 0x53, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0A,
@@ -55,7 +57,45 @@ static const unsigned char TA0_EC_Q[] = {
   0x42, 0x89, 0x89, 0x55, 0x22
 };
 
-static const br_x509_trust_anchor ArduinoIoTCloudTrustAnchor[1] = {
+//iot.arduino.cc:8885
+static const unsigned char TA1_DN[] = {
+  0x30, 0x45, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
+  0x02, 0x55, 0x53, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0A,
+  0x13, 0x0E, 0x41, 0x72, 0x64, 0x75, 0x69, 0x6E, 0x6F, 0x20, 0x4C, 0x4C,
+  0x43, 0x20, 0x55, 0x53, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
+  0x0B, 0x13, 0x02, 0x49, 0x54, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55,
+  0x04, 0x03, 0x13, 0x07, 0x41, 0x72, 0x64, 0x75, 0x69, 0x6E, 0x6F
+};
+
+static const unsigned char TA1_EC_Q[] = {
+  0x04, 0xA1, 0xE1, 0x53, 0x6C, 0x35, 0x52, 0x1A, 0x33, 0x0D, 0xE8, 0x2B,
+  0xAC, 0x5B, 0x12, 0xC1, 0x8F, 0x50, 0x37, 0xB3, 0x3E, 0x64, 0x9B, 0xA0,
+  0xEE, 0x27, 0x02, 0x35, 0xC7, 0x8D, 0x5A, 0x10, 0x45, 0xD0, 0xCA, 0xF5,
+  0x52, 0xEC, 0x97, 0xF2, 0x9A, 0xFF, 0x81, 0xC6, 0xE2, 0x79, 0x97, 0x3F,
+  0xD3, 0x39, 0xC6, 0xD7, 0xA1, 0xCC, 0x6B, 0x61, 0x85, 0x70, 0xF6, 0x3B,
+  0xAE, 0x62, 0x1D, 0x71, 0xC8
+};
+
+//iot.oniudra.cc:8885
+static const unsigned char TA2_DN[] = {
+  0x30, 0x45, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
+  0x02, 0x55, 0x53, 0x31, 0x17, 0x30, 0x15, 0x06, 0x03, 0x55, 0x04, 0x0A,
+  0x13, 0x0E, 0x41, 0x72, 0x64, 0x75, 0x69, 0x6E, 0x6F, 0x20, 0x4C, 0x4C,
+  0x43, 0x20, 0x55, 0x53, 0x31, 0x0B, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
+  0x0B, 0x13, 0x02, 0x49, 0x54, 0x31, 0x10, 0x30, 0x0E, 0x06, 0x03, 0x55,
+  0x04, 0x03, 0x13, 0x07, 0x41, 0x72, 0x64, 0x75, 0x69, 0x6E, 0x6F
+};
+
+static const unsigned char TA2_EC_Q[] = {
+  0x04, 0x11, 0x70, 0x34, 0xE0, 0xC3, 0x3E, 0x00, 0xBD, 0x0B, 0x59, 0x03,
+  0x98, 0xA0, 0x5B, 0x6B, 0x0B, 0x50, 0xDF, 0x51, 0x66, 0x4E, 0xE7, 0x40,
+  0x5D, 0x5A, 0x46, 0x48, 0xE5, 0x30, 0x70, 0x35, 0xF9, 0xF3, 0x6C, 0xFC,
+  0xDB, 0x47, 0x03, 0x78, 0x86, 0x82, 0xC0, 0xEC, 0x60, 0x86, 0x62, 0x3E,
+  0xA7, 0xF0, 0xA9, 0x38, 0x7E, 0xB7, 0x7F, 0x91, 0x7A, 0x87, 0x6D, 0xC4,
+  0xAE, 0xA6, 0x4C, 0x06, 0x48
+};
+
+static const br_x509_trust_anchor ArduinoIoTCloudTrustAnchor[3] = {
   {
     { (unsigned char *)TA0_DN, sizeof TA0_DN },
     BR_X509_TA_CA,
@@ -68,10 +108,36 @@ static const br_x509_trust_anchor ArduinoIoTCloudTrustAnchor[1] = {
         }
       }
     }
+  },
+  {
+    { (unsigned char *)TA1_DN, sizeof TA1_DN },
+    BR_X509_TA_CA,
+    {
+      BR_KEYTYPE_EC,
+      {
+        .ec = {
+          BR_EC_secp256r1,
+          (unsigned char *)TA1_EC_Q, sizeof TA1_EC_Q,
+        }
+      }
+    }
+  },
+  {
+    { (unsigned char *)TA2_DN, sizeof TA2_DN },
+    BR_X509_TA_CA,
+    {
+      BR_KEYTYPE_EC,
+      {
+        .ec = {
+          BR_EC_secp256r1,
+          (unsigned char *)TA2_EC_Q, sizeof TA2_EC_Q,
+        }
+      }
+    }
   }
 };
 
-#define ArduinoIoTCloudTrustAnchor_NUM (1)
+#define ArduinoIoTCloudTrustAnchor_NUM (3)
 
 #endif /* #ifdef BOARD_HAS_ECCX08 */
 

From a32d4735334df17a783c68017d066fac59c8e2a8 Mon Sep 17 00:00:00 2001
From: arduino <info@arduino.cc>
Date: Fri, 10 Jan 2025 11:51:25 +0100
Subject: [PATCH 03/10] Switch from weak variable to updateCertificate(...) API

---
 src/ArduinoIoTCloudTCP.cpp | 70 ++++++++++++++++++++++----------------
 src/ArduinoIoTCloudTCP.h   |  8 +++--
 2 files changed, 47 insertions(+), 31 deletions(-)

diff --git a/src/ArduinoIoTCloudTCP.cpp b/src/ArduinoIoTCloudTCP.cpp
index 4e85e344d..204870782 100644
--- a/src/ArduinoIoTCloudTCP.cpp
+++ b/src/ArduinoIoTCloudTCP.cpp
@@ -43,13 +43,6 @@ unsigned long getTime()
   return ArduinoCloud.getInternalTime();
 }
 
-char NOT_AFTER[]        __attribute__((weak)) = "";
-char NOT_BEFORE[]       __attribute__((weak)) = "";
-char SERIAL_NUMBER[]    __attribute__((weak)) = "";
-char AUTHORITY_KEY_ID[] __attribute__((weak)) = "";
-char SIGNATURE[]        __attribute__((weak)) = "";
-
-
 /******************************************************************************
    CTOR/DTOR
  ******************************************************************************/
@@ -121,33 +114,14 @@ int ArduinoIoTCloudTCP::begin(ConnectionHandler & connection, bool const enable_
       DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device id.", __FUNCTION__);
       return 0;
     }
-    /* read certificate stored in secure element to compare AUTHORITY_KEY_ID */
-    if (!SElementArduinoCloudCertificate::read(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
-    {
-      DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device certificate.", __FUNCTION__);
-      return 0;
-    }
-    /* check if we need to update and try rebuild */
-    int result = SElementArduinoCloudCertificate::update(_selement, _cert, getDeviceId(), String(NOT_BEFORE), String(NOT_AFTER), String(SERIAL_NUMBER), String(AUTHORITY_KEY_ID), String(SIGNATURE));
-    if (result > 0)
-    {
-      DEBUG_INFO("ArduinoIoTCloudTCP::%s device certificate update request.", __FUNCTION__);
-      _writeOnConnect = true;
-    }
-    else if (result < 0)
-    {
-      DEBUG_ERROR("ArduinoIoTCloudTCP::%s device certificate rebuild error.", __FUNCTION__);
-      /* there was an error trying to rebuild certificate re-read old one */
+    if (!_writeOnConnect) {
+      /* No update pending read certificate stored in secure element */
       if (!SElementArduinoCloudCertificate::read(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
       {
-        DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device id.", __FUNCTION__);
+        DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device certificate.", __FUNCTION__);
         return 0;
       }
     }
-    else
-    {
-      DEBUG_VERBOSE("ArduinoIoTCloudTCP::%s device certificate updated.", __FUNCTION__);
-    }
   #if !defined(BOARD_HAS_OFFLOADED_ECCX08)
     _brokerClient.setEccSlot(static_cast<int>(SElementArduinoCloudSlot::Key), _cert.bytes(), _cert.length());
     #if  OTA_ENABLED
@@ -610,6 +584,44 @@ int ArduinoIoTCloudTCP::mqttPort()
     return DEFAULT_BROKER_PORT_SECURE_AUTH;
   }
 }
+
+int ArduinoIoTCloudTCP::updateCertificate(String authorityKeyIdentifier, String serialNumber, String notBefore, String notAfter, String signature)
+{
+  if (!_selement.begin())
+  {
+    DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not initialize secure element.", __FUNCTION__);
+#if defined(ARDUINO_UNOWIFIR4)
+    if (String(WiFi.firmwareVersion()) < String("0.4.1")) {
+      DEBUG_ERROR("ArduinoIoTCloudTCP::%s In order to read device certificate, WiFi firmware needs to be >= 0.4.1, current %s", __FUNCTION__, WiFi.firmwareVersion());
+    }
+#endif
+    return 0;
+  }
+  if (!SElementArduinoCloudDeviceId::read(_selement, getDeviceId(), SElementArduinoCloudSlot::DeviceId))
+  {
+    DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device id.", __FUNCTION__);
+    return 0;
+  }
+  /* read certificate stored in secure element to compare AUTHORITY_KEY_ID */
+  if (!SElementArduinoCloudCertificate::read(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
+  {
+    DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device certificate.", __FUNCTION__);
+    return 0;
+  }
+  /* check if we need to update 0 = equal <0 = error skip rebuild */
+  if(SElementArduinoCloudCertificate::isAuthorityKeyIdDifferent(_cert, authorityKeyIdentifier) <= 0) {
+    DEBUG_INFO("ArduinoIoTCloudTCP::%s request skipped.", __FUNCTION__);
+    return 0;
+  }
+  /* rebuild device certificate */
+  if (SElementArduinoCloudCertificate::rebuild(_selement, _cert, getDeviceId(), notBefore, notAfter, serialNumber, authorityKeyIdentifier, signature))
+  {
+    DEBUG_INFO("ArduinoIoTCloudTCP::%s request started.", __FUNCTION__);
+    _writeOnConnect = true;
+    return 1;
+  }
+  return 0;
+}
 #endif
 
 /******************************************************************************
diff --git a/src/ArduinoIoTCloudTCP.h b/src/ArduinoIoTCloudTCP.h
index d30551f76..7482ef8a9 100644
--- a/src/ArduinoIoTCloudTCP.h
+++ b/src/ArduinoIoTCloudTCP.h
@@ -80,10 +80,14 @@ class ArduinoIoTCloudTCP: public ArduinoIoTCloudClass
     int begin(ConnectionHandler & connection, bool const enable_watchdog = true, String brokerAddress = DEFAULT_BROKER_ADDRESS, uint16_t brokerPort = DEFAULT_BROKER_PORT_AUTO);
     int begin(bool const enable_watchdog = true, String brokerAddress = DEFAULT_BROKER_ADDRESS, uint16_t brokerPort = DEFAULT_BROKER_PORT_AUTO);
 
-    #ifdef BOARD_HAS_SECRET_KEY
+#if defined(BOARD_HAS_SECURE_ELEMENT)
+    int updateCertificate(String authorityKeyIdentifier, String serialNumber, String notBefore, String notAfter, String signature);
+#endif
+
+#ifdef BOARD_HAS_SECRET_KEY
     inline void setBoardId        (String const device_id) { setDeviceId(device_id); }
     inline void setSecretDeviceKey(String const password)  { _password = password;  }
-    #endif
+#endif
 
     inline String   getBrokerAddress() const { return _brokerAddress; }
     inline uint16_t getBrokerPort   () const { return _brokerPort; }

From a882d2c240550dc26abf36634b8c07c8e4011dc1 Mon Sep 17 00:00:00 2001
From: arduino <info@arduino.cc>
Date: Fri, 10 Jan 2025 12:26:18 +0100
Subject: [PATCH 04/10] UNOWiFiR4: force trusted CA from library

---
 src/tls/utility/TLSClientMqtt.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/tls/utility/TLSClientMqtt.cpp b/src/tls/utility/TLSClientMqtt.cpp
index 831f31cf5..b96a83ca1 100644
--- a/src/tls/utility/TLSClientMqtt.cpp
+++ b/src/tls/utility/TLSClientMqtt.cpp
@@ -59,6 +59,8 @@ void TLSClientMqtt::begin(ConnectionHandler & connection) {
    * https://github.com/arduino/uno-r4-wifi-usb-bridge/blob/f09ca94fdcab845b8368d4435fdac9f6999d21d2/certificates/certificates.pem#L852
    */
   (void)connection;
+  /* Temporary force CACert to add new CA without rebuilding firmware */
+  setCACert(AIoTSSCert);
 #elif defined(ARDUINO_ARCH_ESP32)
   #if (ESP_ARDUINO_VERSION < ESP_ARDUINO_VERSION_VAL(3, 0, 4))
     setCACertBundle(x509_crt_bundle);

From 67eccfad9bb6caeee25bc9e5fa05a465193d6fe7 Mon Sep 17 00:00:00 2001
From: arduino <info@arduino.cc>
Date: Fri, 10 Jan 2025 12:53:57 +0100
Subject: [PATCH 05/10] Update SSCert certificates

---
 src/tls/AIoTCSSCert.h | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/src/tls/AIoTCSSCert.h b/src/tls/AIoTCSSCert.h
index 29d71223b..7ba9a3c5f 100644
--- a/src/tls/AIoTCSSCert.h
+++ b/src/tls/AIoTCSSCert.h
@@ -30,6 +30,7 @@
  * CONSTANTS
  ******************************************************************************/
 static const char AIoTSSCert[] =
+/* https://iot.arduino.cc:8883 */
 "-----BEGIN CERTIFICATE-----\n"
 "MIIBzzCCAXSgAwIBAgIUHxAd66fhJecnwaOR4+wNF03tSlkwCgYIKoZIzj0EAwIw\n"
 "RTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkFyZHVpbm8gTExDIFVTMQswCQYDVQQL\n"
@@ -41,6 +42,32 @@ static const char AIoTSSCert[] =
 "VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUWz4qa47JsBqoVOY2m4wJ+fzhuYAwCgYI\n"
 "KoZIzj0EAwIDSQAwRgIhAL/T3CNmaLUK3D8NDsNz4grH92CqEA3TIL/hApabawXY\n"
 "AiEA6tnZ2lrNElKXCajtZg/hjWRE/+giFzBP8riar8qOz2w=\n"
+"-----END CERTIFICATE-----\n"
+/* https://iot.arduino.cc:8885 */
+"-----BEGIN CERTIFICATE-----\n"
+"MIIB0DCCAXagAwIBAgIUb62eK/Vv1baaPAaY5DADBUbxB1owCgYIKoZIzj0EAwIw\n"
+"RTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkFyZHVpbm8gTExDIFVTMQswCQYDVQQL\n"
+"EwJJVDEQMA4GA1UEAxMHQXJkdWlubzAgFw0yNTAxMTAxMDUzMjJaGA8yMDU1MDEw\n"
+"MzEwNTMyMlowRTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkFyZHVpbm8gTExDIFVT\n"
+"MQswCQYDVQQLEwJJVDEQMA4GA1UEAxMHQXJkdWlubzBZMBMGByqGSM49AgEGCCqG\n"
+"SM49AwEHA0IABKHhU2w1UhozDegrrFsSwY9QN7M+ZJug7icCNceNWhBF0Mr1UuyX\n"
+"8pr/gcbieZc/0znG16HMa2GFcPY7rmIdccijQjBAMA8GA1UdEwEB/wQFMAMBAf8w\n"
+"DgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRCZSmE0ASI0cYD9AmzeOM7EijgPjAK\n"
+"BggqhkjOPQQDAgNIADBFAiEAz6TLYP9eiVOr/cVU/11zwGofe/FoNe4p1BlzMl7G\n"
+"VVACIG8tL3Ta2WbIOaUVpBL2gfLuI9WSW1sR++zXP+zFhmen\n"
+"-----END CERTIFICATE-----\n"
+/* https://iot.oniudra.cc:8885 */
+"-----BEGIN CERTIFICATE-----\n"
+"MIIBzzCCAXagAwIBAgIUI5fEitwlnwujc/mU0d8LnDiDXBIwCgYIKoZIzj0EAwIw\n"
+"RTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkFyZHVpbm8gTExDIFVTMQswCQYDVQQL\n"
+"EwJJVDEQMA4GA1UEAxMHQXJkdWlubzAgFw0yNTAxMDgxMTA4MzdaGA8yMDU1MDEw\n"
+"MTExMDgzN1owRTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkFyZHVpbm8gTExDIFVT\n"
+"MQswCQYDVQQLEwJJVDEQMA4GA1UEAxMHQXJkdWlubzBZMBMGByqGSM49AgEGCCqG\n"
+"SM49AwEHA0IABBFwNODDPgC9C1kDmKBbawtQ31FmTudAXVpGSOUwcDX582z820cD\n"
+"eIaCwOxghmI+p/CpOH63f5F6h23ErqZMBkijQjBAMA8GA1UdEwEB/wQFMAMBAf8w\n"
+"DgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBQdnBmQGLB7ls/r1Tetdp+MVMqxfTAK\n"
+"BggqhkjOPQQDAgNHADBEAiBPSZ9HpF7MuFoK4Jsz//PHILQuHM4WmRopQR9ysSs0\n"
+"HAIgNadMPgxv01dy59kCgzehgKzmKdTF0rG1SniYqnkLqPA=\n"
 "-----END CERTIFICATE-----\n";
 
 #endif /* #if defined(BOARD_HAS_SE050) || defined(BOARD_HAS_SOFTSE) */

From d31be30f9daf4d0178739f786e605cf026bd1f52 Mon Sep 17 00:00:00 2001
From: pennam <m.pennasilico@arduino.cc>
Date: Tue, 14 Jan 2025 16:34:42 +0100
Subject: [PATCH 06/10] Save cert right after rebuild on boards using nina-fw

---
 src/ArduinoIoTCloudTCP.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/ArduinoIoTCloudTCP.cpp b/src/ArduinoIoTCloudTCP.cpp
index 204870782..63916032c 100644
--- a/src/ArduinoIoTCloudTCP.cpp
+++ b/src/ArduinoIoTCloudTCP.cpp
@@ -617,7 +617,14 @@ int ArduinoIoTCloudTCP::updateCertificate(String authorityKeyIdentifier, String
   if (SElementArduinoCloudCertificate::rebuild(_selement, _cert, getDeviceId(), notBefore, notAfter, serialNumber, authorityKeyIdentifier, signature))
   {
     DEBUG_INFO("ArduinoIoTCloudTCP::%s request started.", __FUNCTION__);
+#if defined(BOARD_HAS_OFFLOADED_ECCX08)
+    if (SElementArduinoCloudCertificate::write(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
+    {
+      DEBUG_INFO("ArduinoIoTCloudTCP::%s update done.", __FUNCTION__);
+    }
+#else
     _writeOnConnect = true;
+#endif
     return 1;
   }
   return 0;

From 9de14b55a25c600b56260fc29ffa4318e7c94153 Mon Sep 17 00:00:00 2001
From: pennam <m.pennasilico@arduino.cc>
Date: Fri, 17 Jan 2025 11:03:53 +0100
Subject: [PATCH 07/10] Compare certificates signatures insted of authority key
 identifier

---
 src/ArduinoIoTCloudTCP.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ArduinoIoTCloudTCP.cpp b/src/ArduinoIoTCloudTCP.cpp
index 63916032c..7f799b127 100644
--- a/src/ArduinoIoTCloudTCP.cpp
+++ b/src/ArduinoIoTCloudTCP.cpp
@@ -609,7 +609,7 @@ int ArduinoIoTCloudTCP::updateCertificate(String authorityKeyIdentifier, String
     return 0;
   }
   /* check if we need to update 0 = equal <0 = error skip rebuild */
-  if(SElementArduinoCloudCertificate::isAuthorityKeyIdDifferent(_cert, authorityKeyIdentifier) <= 0) {
+  if(SElementArduinoCloudCertificate::signatureCompare(_cert.signatureBytes(), signature) <= 0) {
     DEBUG_INFO("ArduinoIoTCloudTCP::%s request skipped.", __FUNCTION__);
     return 0;
   }

From 165b2d4e1c75ebde53a4da8cb08fe809732e8653 Mon Sep 17 00:00:00 2001
From: pennam <m.pennasilico@arduino.cc>
Date: Fri, 17 Jan 2025 14:10:31 +0100
Subject: [PATCH 08/10] Update UPCert certificates

---
 src/tls/AIoTCUPCert.h             | 265 +++++-------------------------
 src/tls/utility/TLSClientMqtt.cpp |   6 +-
 src/tls/utility/TLSClientOta.cpp  |   6 +-
 3 files changed, 47 insertions(+), 230 deletions(-)

diff --git a/src/tls/AIoTCUPCert.h b/src/tls/AIoTCUPCert.h
index 5c933da03..f13e72878 100644
--- a/src/tls/AIoTCUPCert.h
+++ b/src/tls/AIoTCUPCert.h
@@ -24,231 +24,13 @@
  ******************************************************************************/
 
 #include <AIoTC_Config.h>
-#if defined(ARDUINO_ARCH_ESP32)
+#if defined(ARDUINO_ARCH_ESP32) ||  defined (ARDUINO_EDGE_CONTROL)
 
 /******************************************************************************
  * CONSTANTS
  ******************************************************************************/
-
-/* This certificate bundle is created using the following certificates:
-
-   * https://www.amazontrust.com/repository/AmazonRootCA1.pem
-   * https://www.amazontrust.com/repository/AmazonRootCA2.pem
-   * https://www.amazontrust.com/repository/AmazonRootCA3.pem
-   * https://www.amazontrust.com/repository/AmazonRootCA4.pem
-   * https://www.amazontrust.com/repository/SFSRootCAG2.pem
-   * https://certs.secureserver.net/repository/sf-class2-root.crt
-   * https://iot.arduino.cc
-
- */
-
-static const unsigned char x509_crt_bundle[] = {
-  0x00, 0x07, 0x00, 0x3b, 0x01, 0x26, 0x30, 0x39, 0x31, 0x0b, 0x30, 0x09,
-  0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x0f, 0x30,
-  0x0d, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x06, 0x41, 0x6d, 0x61, 0x7a,
-  0x6f, 0x6e, 0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
-  0x10, 0x41, 0x6d, 0x61, 0x7a, 0x6f, 0x6e, 0x20, 0x52, 0x6f, 0x6f, 0x74,
-  0x20, 0x43, 0x41, 0x20, 0x31, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06,
-  0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00,
-  0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01,
-  0x01, 0x00, 0xb2, 0x78, 0x80, 0x71, 0xca, 0x78, 0xd5, 0xe3, 0x71, 0xaf,
-  0x47, 0x80, 0x50, 0x74, 0x7d, 0x6e, 0xd8, 0xd7, 0x88, 0x76, 0xf4, 0x99,
-  0x68, 0xf7, 0x58, 0x21, 0x60, 0xf9, 0x74, 0x84, 0x01, 0x2f, 0xac, 0x02,
-  0x2d, 0x86, 0xd3, 0xa0, 0x43, 0x7a, 0x4e, 0xb2, 0xa4, 0xd0, 0x36, 0xba,
-  0x01, 0xbe, 0x8d, 0xdb, 0x48, 0xc8, 0x07, 0x17, 0x36, 0x4c, 0xf4, 0xee,
-  0x88, 0x23, 0xc7, 0x3e, 0xeb, 0x37, 0xf5, 0xb5, 0x19, 0xf8, 0x49, 0x68,
-  0xb0, 0xde, 0xd7, 0xb9, 0x76, 0x38, 0x1d, 0x61, 0x9e, 0xa4, 0xfe, 0x82,
-  0x36, 0xa5, 0xe5, 0x4a, 0x56, 0xe4, 0x45, 0xe1, 0xf9, 0xfd, 0xb4, 0x16,
-  0xfa, 0x74, 0xda, 0x9c, 0x9b, 0x35, 0x39, 0x2f, 0xfa, 0xb0, 0x20, 0x50,
-  0x06, 0x6c, 0x7a, 0xd0, 0x80, 0xb2, 0xa6, 0xf9, 0xaf, 0xec, 0x47, 0x19,
-  0x8f, 0x50, 0x38, 0x07, 0xdc, 0xa2, 0x87, 0x39, 0x58, 0xf8, 0xba, 0xd5,
-  0xa9, 0xf9, 0x48, 0x67, 0x30, 0x96, 0xee, 0x94, 0x78, 0x5e, 0x6f, 0x89,
-  0xa3, 0x51, 0xc0, 0x30, 0x86, 0x66, 0xa1, 0x45, 0x66, 0xba, 0x54, 0xeb,
-  0xa3, 0xc3, 0x91, 0xf9, 0x48, 0xdc, 0xff, 0xd1, 0xe8, 0x30, 0x2d, 0x7d,
-  0x2d, 0x74, 0x70, 0x35, 0xd7, 0x88, 0x24, 0xf7, 0x9e, 0xc4, 0x59, 0x6e,
-  0xbb, 0x73, 0x87, 0x17, 0xf2, 0x32, 0x46, 0x28, 0xb8, 0x43, 0xfa, 0xb7,
-  0x1d, 0xaa, 0xca, 0xb4, 0xf2, 0x9f, 0x24, 0x0e, 0x2d, 0x4b, 0xf7, 0x71,
-  0x5c, 0x5e, 0x69, 0xff, 0xea, 0x95, 0x02, 0xcb, 0x38, 0x8a, 0xae, 0x50,
-  0x38, 0x6f, 0xdb, 0xfb, 0x2d, 0x62, 0x1b, 0xc5, 0xc7, 0x1e, 0x54, 0xe1,
-  0x77, 0xe0, 0x67, 0xc8, 0x0f, 0x9c, 0x87, 0x23, 0xd6, 0x3f, 0x40, 0x20,
-  0x7f, 0x20, 0x80, 0xc4, 0x80, 0x4c, 0x3e, 0x3b, 0x24, 0x26, 0x8e, 0x04,
-  0xae, 0x6c, 0x9a, 0xc8, 0xaa, 0x0d, 0x02, 0x03, 0x01, 0x00, 0x01, 0x00,
-  0x3b, 0x02, 0x26, 0x30, 0x39, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55,
-  0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x0f, 0x30, 0x0d, 0x06, 0x03,
-  0x55, 0x04, 0x0a, 0x13, 0x06, 0x41, 0x6d, 0x61, 0x7a, 0x6f, 0x6e, 0x31,
-  0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x10, 0x41, 0x6d,
-  0x61, 0x7a, 0x6f, 0x6e, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41,
-  0x20, 0x32, 0x30, 0x82, 0x02, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
-  0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x02,
-  0x0f, 0x00, 0x30, 0x82, 0x02, 0x0a, 0x02, 0x82, 0x02, 0x01, 0x00, 0xad,
-  0x96, 0x9f, 0x2d, 0x9c, 0x4a, 0x4c, 0x4a, 0x81, 0x79, 0x51, 0x99, 0xec,
-  0x8a, 0xcb, 0x6b, 0x60, 0x51, 0x13, 0xbc, 0x4d, 0x6d, 0x06, 0xfc, 0xb0,
-  0x08, 0x8d, 0xdd, 0x19, 0x10, 0x6a, 0xc7, 0x26, 0x0c, 0x35, 0xd8, 0xc0,
-  0x6f, 0x20, 0x84, 0xe9, 0x94, 0xb1, 0x9b, 0x85, 0x03, 0xc3, 0x5b, 0xdb,
-  0x4a, 0xe8, 0xc8, 0xf8, 0x90, 0x76, 0xd9, 0x5b, 0x4f, 0xe3, 0x4c, 0xe8,
-  0x06, 0x36, 0x4d, 0xcc, 0x9a, 0xac, 0x3d, 0x0c, 0x90, 0x2b, 0x92, 0xd4,
-  0x06, 0x19, 0x60, 0xac, 0x37, 0x44, 0x79, 0x85, 0x81, 0x82, 0xad, 0x5a,
-  0x37, 0xe0, 0x0d, 0xcc, 0x9d, 0xa6, 0x4c, 0x52, 0x76, 0xea, 0x43, 0x9d,
-  0xb7, 0x04, 0xd1, 0x50, 0xf6, 0x55, 0xe0, 0xd5, 0xd2, 0xa6, 0x49, 0x85,
-  0xe9, 0x37, 0xe9, 0xca, 0x7e, 0xae, 0x5c, 0x95, 0x4d, 0x48, 0x9a, 0x3f,
-  0xae, 0x20, 0x5a, 0x6d, 0x88, 0x95, 0xd9, 0x34, 0xb8, 0x52, 0x1a, 0x43,
-  0x90, 0xb0, 0xbf, 0x6c, 0x05, 0xb9, 0xb6, 0x78, 0xb7, 0xea, 0xd0, 0xe4,
-  0x3a, 0x3c, 0x12, 0x53, 0x62, 0xff, 0x4a, 0xf2, 0x7b, 0xbe, 0x35, 0x05,
-  0xa9, 0x12, 0x34, 0xe3, 0xf3, 0x64, 0x74, 0x62, 0x2c, 0x3d, 0x00, 0x49,
-  0x5a, 0x28, 0xfe, 0x32, 0x44, 0xbb, 0x87, 0xdd, 0x65, 0x27, 0x02, 0x71,
-  0x3b, 0xda, 0x4a, 0xf7, 0x1f, 0xda, 0xcd, 0xf7, 0x21, 0x55, 0x90, 0x4f,
-  0x0f, 0xec, 0xae, 0x82, 0xe1, 0x9f, 0x6b, 0xd9, 0x45, 0xd3, 0xbb, 0xf0,
-  0x5f, 0x87, 0xed, 0x3c, 0x2c, 0x39, 0x86, 0xda, 0x3f, 0xde, 0xec, 0x72,
-  0x55, 0xeb, 0x79, 0xa3, 0xad, 0xdb, 0xdd, 0x7c, 0xb0, 0xba, 0x1c, 0xce,
-  0xfc, 0xde, 0x4f, 0x35, 0x76, 0xcf, 0x0f, 0xf8, 0x78, 0x1f, 0x6a, 0x36,
-  0x51, 0x46, 0x27, 0x61, 0x5b, 0xe9, 0x9e, 0xcf, 0xf0, 0xa2, 0x55, 0x7d,
-  0x7c, 0x25, 0x8a, 0x6f, 0x2f, 0xb4, 0xc5, 0xcf, 0x84, 0x2e, 0x2b, 0xfd,
-  0x0d, 0x51, 0x10, 0x6c, 0xfb, 0x5f, 0x1b, 0xbc, 0x1b, 0x7e, 0xc5, 0xae,
-  0x3b, 0x98, 0x01, 0x31, 0x92, 0xff, 0x0b, 0x57, 0xf4, 0x9a, 0xb2, 0xb9,
-  0x57, 0xe9, 0xab, 0xef, 0x0d, 0x76, 0xd1, 0xf0, 0xee, 0xf4, 0xce, 0x86,
-  0xa7, 0xe0, 0x6e, 0xe9, 0xb4, 0x69, 0xa1, 0xdf, 0x69, 0xf6, 0x33, 0xc6,
-  0x69, 0x2e, 0x97, 0x13, 0x9e, 0xa5, 0x87, 0xb0, 0x57, 0x10, 0x81, 0x37,
-  0xc9, 0x53, 0xb3, 0xbb, 0x7f, 0xf6, 0x92, 0xd1, 0x9c, 0xd0, 0x18, 0xf4,
-  0x92, 0x6e, 0xda, 0x83, 0x4f, 0xa6, 0x63, 0x99, 0x4c, 0xa5, 0xfb, 0x5e,
-  0xef, 0x21, 0x64, 0x7a, 0x20, 0x5f, 0x6c, 0x64, 0x85, 0x15, 0xcb, 0x37,
-  0xe9, 0x62, 0x0c, 0x0b, 0x2a, 0x16, 0xdc, 0x01, 0x2e, 0x32, 0xda, 0x3e,
-  0x4b, 0xf5, 0x9e, 0x3a, 0xf6, 0x17, 0x40, 0x94, 0xef, 0x9e, 0x91, 0x08,
-  0x86, 0xfa, 0xbe, 0x63, 0xa8, 0x5a, 0x33, 0xec, 0xcb, 0x74, 0x43, 0x95,
-  0xf9, 0x6c, 0x69, 0x52, 0x36, 0xc7, 0x29, 0x6f, 0xfc, 0x55, 0x03, 0x5c,
-  0x1f, 0xfb, 0x9f, 0xbd, 0x47, 0xeb, 0xe7, 0x49, 0x47, 0x95, 0x0b, 0x4e,
-  0x89, 0x22, 0x09, 0x49, 0xe0, 0xf5, 0x61, 0x1e, 0xf1, 0xbf, 0x2e, 0x8a,
-  0x72, 0x6e, 0x80, 0x59, 0xff, 0x57, 0x3a, 0xf9, 0x75, 0x32, 0xa3, 0x4e,
-  0x5f, 0xec, 0xed, 0x28, 0x62, 0xd9, 0x4d, 0x73, 0xf2, 0xcc, 0x81, 0x17,
-  0x60, 0xed, 0xcd, 0xeb, 0xdc, 0xdb, 0xa7, 0xca, 0xc5, 0x7e, 0x02, 0xbd,
-  0xf2, 0x54, 0x08, 0x54, 0xfd, 0xb4, 0x2d, 0x09, 0x2c, 0x17, 0x54, 0x4a,
-  0x98, 0xd1, 0x54, 0xe1, 0x51, 0x67, 0x08, 0xd2, 0xed, 0x6e, 0x7e, 0x6f,
-  0x3f, 0xd2, 0x2d, 0x81, 0x59, 0x29, 0x66, 0xcb, 0x90, 0x39, 0x95, 0x11,
-  0x1e, 0x74, 0x27, 0xfe, 0xdd, 0xeb, 0xaf, 0x02, 0x03, 0x01, 0x00, 0x01,
-  0x00, 0x3b, 0x00, 0x5b, 0x30, 0x39, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03,
-  0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x0f, 0x30, 0x0d, 0x06,
-  0x03, 0x55, 0x04, 0x0a, 0x13, 0x06, 0x41, 0x6d, 0x61, 0x7a, 0x6f, 0x6e,
-  0x31, 0x19, 0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x10, 0x41,
-  0x6d, 0x61, 0x7a, 0x6f, 0x6e, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43,
-  0x41, 0x20, 0x33, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48,
-  0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03,
-  0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x29, 0x97, 0xa7, 0xc6, 0x41, 0x7f,
-  0xc0, 0x0d, 0x9b, 0xe8, 0x01, 0x1b, 0x56, 0xc6, 0xf2, 0x52, 0xa5, 0xba,
-  0x2d, 0xb2, 0x12, 0xe8, 0xd2, 0x2e, 0xd7, 0xfa, 0xc9, 0xc5, 0xd8, 0xaa,
-  0x6d, 0x1f, 0x73, 0x81, 0x3b, 0x3b, 0x98, 0x6b, 0x39, 0x7c, 0x33, 0xa5,
-  0xc5, 0x4e, 0x86, 0x8e, 0x80, 0x17, 0x68, 0x62, 0x45, 0x57, 0x7d, 0x44,
-  0x58, 0x1d, 0xb3, 0x37, 0xe5, 0x67, 0x08, 0xeb, 0x66, 0xde, 0x00, 0x3b,
-  0x00, 0x78, 0x30, 0x39, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04,
-  0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x0f, 0x30, 0x0d, 0x06, 0x03, 0x55,
-  0x04, 0x0a, 0x13, 0x06, 0x41, 0x6d, 0x61, 0x7a, 0x6f, 0x6e, 0x31, 0x19,
-  0x30, 0x17, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x10, 0x41, 0x6d, 0x61,
-  0x7a, 0x6f, 0x6e, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x20,
-  0x34, 0x30, 0x76, 0x30, 0x10, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d,
-  0x02, 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x22, 0x03, 0x62, 0x00,
-  0x04, 0xd2, 0xab, 0x8a, 0x37, 0x4f, 0xa3, 0x53, 0x0d, 0xfe, 0xc1, 0x8a,
-  0x7b, 0x4b, 0xa8, 0x7b, 0x46, 0x4b, 0x63, 0xb0, 0x62, 0xf6, 0x2d, 0x1b,
-  0xdb, 0x08, 0x71, 0x21, 0xd2, 0x00, 0xe8, 0x63, 0xbd, 0x9a, 0x27, 0xfb,
-  0xf0, 0x39, 0x6e, 0x5d, 0xea, 0x3d, 0xa5, 0xc9, 0x81, 0xaa, 0xa3, 0x5b,
-  0x20, 0x98, 0x45, 0x5d, 0x16, 0xdb, 0xfd, 0xe8, 0x10, 0x6d, 0xe3, 0x9c,
-  0xe0, 0xe3, 0xbd, 0x5f, 0x84, 0x62, 0xf3, 0x70, 0x64, 0x33, 0xa0, 0xcb,
-  0x24, 0x2f, 0x70, 0xba, 0x88, 0xa1, 0x2a, 0xa0, 0x75, 0xf8, 0x81, 0xae,
-  0x62, 0x06, 0xc4, 0x81, 0xdb, 0x39, 0x6e, 0x29, 0xb0, 0x1e, 0xfa, 0x2e,
-  0x5c, 0x00, 0x47, 0x00, 0x5b, 0x30, 0x45, 0x31, 0x0b, 0x30, 0x09, 0x06,
-  0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x17, 0x30, 0x15,
-  0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0e, 0x41, 0x72, 0x64, 0x75, 0x69,
-  0x6e, 0x6f, 0x20, 0x4c, 0x4c, 0x43, 0x20, 0x55, 0x53, 0x31, 0x0b, 0x30,
-  0x09, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x02, 0x49, 0x54, 0x31, 0x10,
-  0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x07, 0x41, 0x72, 0x64,
-  0x75, 0x69, 0x6e, 0x6f, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86,
-  0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d,
-  0x03, 0x01, 0x07, 0x03, 0x42, 0x00, 0x04, 0x6d, 0x77, 0x6c, 0x5a, 0xcf,
-  0x61, 0x1c, 0x7d, 0x44, 0x98, 0x51, 0xf2, 0x5e, 0xe1, 0x02, 0x40, 0x77,
-  0xb7, 0x9c, 0xbd, 0x49, 0xa2, 0xa3, 0x8c, 0x4e, 0xab, 0x5e, 0x98, 0xac,
-  0x82, 0xfc, 0x69, 0x5b, 0x44, 0x22, 0x77, 0xb4, 0x4d, 0x2e, 0x8e, 0xdf,
-  0x2a, 0x71, 0xc1, 0x39, 0x6c, 0xd6, 0x39, 0x14, 0xbd, 0xd9, 0x6b, 0x18,
-  0x4b, 0x4b, 0xec, 0xb3, 0xd5, 0xee, 0x42, 0x89, 0x89, 0x55, 0x22, 0x00,
-  0x6a, 0x01, 0x24, 0x30, 0x68, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55,
-  0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03,
-  0x55, 0x04, 0x0a, 0x13, 0x1c, 0x53, 0x74, 0x61, 0x72, 0x66, 0x69, 0x65,
-  0x6c, 0x64, 0x20, 0x54, 0x65, 0x63, 0x68, 0x6e, 0x6f, 0x6c, 0x6f, 0x67,
-  0x69, 0x65, 0x73, 0x2c, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x32, 0x30,
-  0x30, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13, 0x29, 0x53, 0x74, 0x61, 0x72,
-  0x66, 0x69, 0x65, 0x6c, 0x64, 0x20, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x20,
-  0x32, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74,
-  0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74,
-  0x79, 0x30, 0x82, 0x01, 0x20, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48,
-  0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0d,
-  0x00, 0x30, 0x82, 0x01, 0x08, 0x02, 0x82, 0x01, 0x01, 0x00, 0xb7, 0x32,
-  0xc8, 0xfe, 0xe9, 0x71, 0xa6, 0x04, 0x85, 0xad, 0x0c, 0x11, 0x64, 0xdf,
-  0xce, 0x4d, 0xef, 0xc8, 0x03, 0x18, 0x87, 0x3f, 0xa1, 0xab, 0xfb, 0x3c,
-  0xa6, 0x9f, 0xf0, 0xc3, 0xa1, 0xda, 0xd4, 0xd8, 0x6e, 0x2b, 0x53, 0x90,
-  0xfb, 0x24, 0xa4, 0x3e, 0x84, 0xf0, 0x9e, 0xe8, 0x5f, 0xec, 0xe5, 0x27,
-  0x44, 0xf5, 0x28, 0xa6, 0x3f, 0x7b, 0xde, 0xe0, 0x2a, 0xf0, 0xc8, 0xaf,
-  0x53, 0x2f, 0x9e, 0xca, 0x05, 0x01, 0x93, 0x1e, 0x8f, 0x66, 0x1c, 0x39,
-  0xa7, 0x4d, 0xfa, 0x5a, 0xb6, 0x73, 0x04, 0x25, 0x66, 0xeb, 0x77, 0x7f,
-  0xe7, 0x59, 0xc6, 0x4a, 0x99, 0x25, 0x14, 0x54, 0xeb, 0x26, 0xc7, 0xf3,
-  0x7f, 0x19, 0xd5, 0x30, 0x70, 0x8f, 0xaf, 0xb0, 0x46, 0x2a, 0xff, 0xad,
-  0xeb, 0x29, 0xed, 0xd7, 0x9f, 0xaa, 0x04, 0x87, 0xa3, 0xd4, 0xf9, 0x89,
-  0xa5, 0x34, 0x5f, 0xdb, 0x43, 0x91, 0x82, 0x36, 0xd9, 0x66, 0x3c, 0xb1,
-  0xb8, 0xb9, 0x82, 0xfd, 0x9c, 0x3a, 0x3e, 0x10, 0xc8, 0x3b, 0xef, 0x06,
-  0x65, 0x66, 0x7a, 0x9b, 0x19, 0x18, 0x3d, 0xff, 0x71, 0x51, 0x3c, 0x30,
-  0x2e, 0x5f, 0xbe, 0x3d, 0x77, 0x73, 0xb2, 0x5d, 0x06, 0x6c, 0xc3, 0x23,
-  0x56, 0x9a, 0x2b, 0x85, 0x26, 0x92, 0x1c, 0xa7, 0x02, 0xb3, 0xe4, 0x3f,
-  0x0d, 0xaf, 0x08, 0x79, 0x82, 0xb8, 0x36, 0x3d, 0xea, 0x9c, 0xd3, 0x35,
-  0xb3, 0xbc, 0x69, 0xca, 0xf5, 0xcc, 0x9d, 0xe8, 0xfd, 0x64, 0x8d, 0x17,
-  0x80, 0x33, 0x6e, 0x5e, 0x4a, 0x5d, 0x99, 0xc9, 0x1e, 0x87, 0xb4, 0x9d,
-  0x1a, 0xc0, 0xd5, 0x6e, 0x13, 0x35, 0x23, 0x5e, 0xdf, 0x9b, 0x5f, 0x3d,
-  0xef, 0xd6, 0xf7, 0x76, 0xc2, 0xea, 0x3e, 0xbb, 0x78, 0x0d, 0x1c, 0x42,
-  0x67, 0x6b, 0x04, 0xd8, 0xf8, 0xd6, 0xda, 0x6f, 0x8b, 0xf2, 0x44, 0xa0,
-  0x01, 0xab, 0x02, 0x01, 0x03, 0x00, 0x9b, 0x01, 0x26, 0x30, 0x81, 0x98,
-  0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55,
-  0x53, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x08, 0x13, 0x07,
-  0x41, 0x72, 0x69, 0x7a, 0x6f, 0x6e, 0x61, 0x31, 0x13, 0x30, 0x11, 0x06,
-  0x03, 0x55, 0x04, 0x07, 0x13, 0x0a, 0x53, 0x63, 0x6f, 0x74, 0x74, 0x73,
-  0x64, 0x61, 0x6c, 0x65, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, 0x04,
-  0x0a, 0x13, 0x1c, 0x53, 0x74, 0x61, 0x72, 0x66, 0x69, 0x65, 0x6c, 0x64,
-  0x20, 0x54, 0x65, 0x63, 0x68, 0x6e, 0x6f, 0x6c, 0x6f, 0x67, 0x69, 0x65,
-  0x73, 0x2c, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x3b, 0x30, 0x39, 0x06,
-  0x03, 0x55, 0x04, 0x03, 0x13, 0x32, 0x53, 0x74, 0x61, 0x72, 0x66, 0x69,
-  0x65, 0x6c, 0x64, 0x20, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
-  0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66,
-  0x69, 0x63, 0x61, 0x74, 0x65, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
-  0x69, 0x74, 0x79, 0x20, 0x2d, 0x20, 0x47, 0x32, 0x30, 0x82, 0x01, 0x22,
-  0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01,
-  0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a,
-  0x02, 0x82, 0x01, 0x01, 0x00, 0xd5, 0x0c, 0x3a, 0xc4, 0x2a, 0xf9, 0x4e,
-  0xe2, 0xf5, 0xbe, 0x19, 0x97, 0x5f, 0x8e, 0x88, 0x53, 0xb1, 0x1f, 0x3f,
-  0xcb, 0xcf, 0x9f, 0x20, 0x13, 0x6d, 0x29, 0x3a, 0xc8, 0x0f, 0x7d, 0x3c,
-  0xf7, 0x6b, 0x76, 0x38, 0x63, 0xd9, 0x36, 0x60, 0xa8, 0x9b, 0x5e, 0x5c,
-  0x00, 0x80, 0xb2, 0x2f, 0x59, 0x7f, 0xf6, 0x87, 0xf9, 0x25, 0x43, 0x86,
-  0xe7, 0x69, 0x1b, 0x52, 0x9a, 0x90, 0xe1, 0x71, 0xe3, 0xd8, 0x2d, 0x0d,
-  0x4e, 0x6f, 0xf6, 0xc8, 0x49, 0xd9, 0xb6, 0xf3, 0x1a, 0x56, 0xae, 0x2b,
-  0xb6, 0x74, 0x14, 0xeb, 0xcf, 0xfb, 0x26, 0xe3, 0x1a, 0xba, 0x1d, 0x96,
-  0x2e, 0x6a, 0x3b, 0x58, 0x94, 0x89, 0x47, 0x56, 0xff, 0x25, 0xa0, 0x93,
-  0x70, 0x53, 0x83, 0xda, 0x84, 0x74, 0x14, 0xc3, 0x67, 0x9e, 0x04, 0x68,
-  0x3a, 0xdf, 0x8e, 0x40, 0x5a, 0x1d, 0x4a, 0x4e, 0xcf, 0x43, 0x91, 0x3b,
-  0xe7, 0x56, 0xd6, 0x00, 0x70, 0xcb, 0x52, 0xee, 0x7b, 0x7d, 0xae, 0x3a,
-  0xe7, 0xbc, 0x31, 0xf9, 0x45, 0xf6, 0xc2, 0x60, 0xcf, 0x13, 0x59, 0x02,
-  0x2b, 0x80, 0xcc, 0x34, 0x47, 0xdf, 0xb9, 0xde, 0x90, 0x65, 0x6d, 0x02,
-  0xcf, 0x2c, 0x91, 0xa6, 0xa6, 0xe7, 0xde, 0x85, 0x18, 0x49, 0x7c, 0x66,
-  0x4e, 0xa3, 0x3a, 0x6d, 0xa9, 0xb5, 0xee, 0x34, 0x2e, 0xba, 0x0d, 0x03,
-  0xb8, 0x33, 0xdf, 0x47, 0xeb, 0xb1, 0x6b, 0x8d, 0x25, 0xd9, 0x9b, 0xce,
-  0x81, 0xd1, 0x45, 0x46, 0x32, 0x96, 0x70, 0x87, 0xde, 0x02, 0x0e, 0x49,
-  0x43, 0x85, 0xb6, 0x6c, 0x73, 0xbb, 0x64, 0xea, 0x61, 0x41, 0xac, 0xc9,
-  0xd4, 0x54, 0xdf, 0x87, 0x2f, 0xc7, 0x22, 0xb2, 0x26, 0xcc, 0x9f, 0x59,
-  0x54, 0x68, 0x9f, 0xfc, 0xbe, 0x2a, 0x2f, 0xc4, 0x55, 0x1c, 0x75, 0x40,
-  0x60, 0x17, 0x85, 0x02, 0x55, 0x39, 0x8b, 0x7f, 0x05, 0x02, 0x03, 0x01,
-  0x00, 0x01
-};
-
-#elif defined (ARDUINO_EDGE_CONTROL)
-  /*
-   * https://www.amazontrust.com/repository/AmazonRootCA1.pem
-   * https://www.amazontrust.com/repository/AmazonRootCA2.pem
-   * https://www.amazontrust.com/repository/AmazonRootCA3.pem
-   * https://www.amazontrust.com/repository/AmazonRootCA4.pem
-   * https://www.amazontrust.com/repository/SFSRootCAG2.pem
-   */
 static const char AIoTUPCert[] =
+/* https://www.amazontrust.com/repository/AmazonRootCA1.pem */
 "-----BEGIN CERTIFICATE-----\n"
 "MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF\n"
 "ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6\n"
@@ -269,6 +51,7 @@ static const char AIoTUPCert[] =
 "5MsI+yMRQ+hDKXJioaldXgjUkK642M4UwtBV8ob2xJNDd2ZhwLnoQdeXeGADbkpy\n"
 "rqXRfboQnoZsG4q5WTP468SQvvG5\n"
 "-----END CERTIFICATE-----\n"
+/* https://www.amazontrust.com/repository/AmazonRootCA2.pem */
 "-----BEGIN CERTIFICATE-----\n"
 "MIIFQTCCAymgAwIBAgITBmyf0pY1hp8KD+WGePhbJruKNzANBgkqhkiG9w0BAQwF\n"
 "ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6\n"
@@ -300,6 +83,7 @@ static const char AIoTUPCert[] =
 "9jVlpNMKVv/1F2Rs76giJUmTtt8AF9pYfl3uxRuw0dFfIRDH+fO6AgonB8Xx1sfT\n"
 "4PsJYGw=\n"
 "-----END CERTIFICATE-----\n"
+/* https://www.amazontrust.com/repository/AmazonRootCA3.pem */
 "-----BEGIN CERTIFICATE-----\n"
 "MIIBtjCCAVugAwIBAgITBmyf1XSXNmY/Owua2eiedgPySjAKBggqhkjOPQQDAjA5\n"
 "MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g\n"
@@ -312,6 +96,7 @@ static const char AIoTUPCert[] =
 "BqWTrBqYaGFy+uGh0PsceGCmQ5nFuMQCIQCcAu/xlJyzlvnrxir4tiz+OpAUFteM\n"
 "YyRIHN8wfdVoOw==\n"
 "-----END CERTIFICATE-----\n"
+/* https://www.amazontrust.com/repository/AmazonRootCA4.pem */
 "-----BEGIN CERTIFICATE-----\n"
 "MIIB8jCCAXigAwIBAgITBmyf18G7EEwpQ+Vxe3ssyBrBDjAKBggqhkjOPQQDAzA5\n"
 "MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6b24g\n"
@@ -325,6 +110,7 @@ static const char AIoTUPCert[] =
 "CkcO8DdZEv8tmZQoTipPNU0zWgIxAOp1AE47xDqUEpHJWEadIRNyp4iciuRMStuW\n"
 "1KyLa2tJElMzrdfkviT8tQp21KW8EA==\n"
 "-----END CERTIFICATE-----\n"
+/* https://www.amazontrust.com/repository/SFSRootCAG2.pem */
 "-----BEGIN CERTIFICATE-----\n"
 "MIID7zCCAtegAwIBAgIBADANBgkqhkiG9w0BAQsFADCBmDELMAkGA1UEBhMCVVMx\n"
 "EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxJTAjBgNVBAoT\n"
@@ -348,6 +134,45 @@ static const char AIoTUPCert[] =
 "iEDPfUYd/x7H4c7/I9vG+o1VTqkC50cRRj70/b17KSa7qWFiNyi2LSr2EIZkyXCn\n"
 "0q23KXB56jzaYyWf/Wi3MOxw+3WKt21gZ7IeyLnp2KhvAotnDU0mV3HaIPzBSlCN\n"
 "sSi6\n"
+"-----END CERTIFICATE-----\n"
+/* iot.arduino.cc:8883 / iot.oniudra.cc:8883 */
+"-----BEGIN CERTIFICATE-----\n"
+"MIIBzzCCAXSgAwIBAgIUHxAd66fhJecnwaOR4+wNF03tSlkwCgYIKoZIzj0EAwIw\n"
+"RTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkFyZHVpbm8gTExDIFVTMQswCQYDVQQL\n"
+"EwJJVDEQMA4GA1UEAxMHQXJkdWlubzAeFw0xODA3MjQwOTQ3MDBaFw00ODA3MTYw\n"
+"OTQ3MDBaMEUxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5BcmR1aW5vIExMQyBVUzEL\n"
+"MAkGA1UECxMCSVQxEDAOBgNVBAMTB0FyZHVpbm8wWTATBgcqhkjOPQIBBggqhkjO\n"
+"PQMBBwNCAARtd2xaz2EcfUSYUfJe4QJAd7ecvUmio4xOq16YrIL8aVtEIne0TS6O\n"
+"3ypxwTls1jkUvdlrGEtL7LPV7kKJiVUio0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYD\n"
+"VR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUWz4qa47JsBqoVOY2m4wJ+fzhuYAwCgYI\n"
+"KoZIzj0EAwIDSQAwRgIhAL/T3CNmaLUK3D8NDsNz4grH92CqEA3TIL/hApabawXY\n"
+"AiEA6tnZ2lrNElKXCajtZg/hjWRE/+giFzBP8riar8qOz2w=\n"
+"-----END CERTIFICATE--------\n"
+/* iot.arduino.cc:8885 */
+"-----BEGIN CERTIFICATE-----\n"
+"MIIB0DCCAXagAwIBAgIUb62eK/Vv1baaPAaY5DADBUbxB1owCgYIKoZIzj0EAwIw\n"
+"RTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkFyZHVpbm8gTExDIFVTMQswCQYDVQQL\n"
+"EwJJVDEQMA4GA1UEAxMHQXJkdWlubzAgFw0yNTAxMTAxMDUzMjJaGA8yMDU1MDEw\n"
+"MzEwNTMyMlowRTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkFyZHVpbm8gTExDIFVT\n"
+"MQswCQYDVQQLEwJJVDEQMA4GA1UEAxMHQXJkdWlubzBZMBMGByqGSM49AgEGCCqG\n"
+"SM49AwEHA0IABKHhU2w1UhozDegrrFsSwY9QN7M+ZJug7icCNceNWhBF0Mr1UuyX\n"
+"8pr/gcbieZc/0znG16HMa2GFcPY7rmIdccijQjBAMA8GA1UdEwEB/wQFMAMBAf8w\n"
+"DgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRCZSmE0ASI0cYD9AmzeOM7EijgPjAK\n"
+"BggqhkjOPQQDAgNIADBFAiEAz6TLYP9eiVOr/cVU/11zwGofe/FoNe4p1BlzMl7G\n"
+"VVACIG8tL3Ta2WbIOaUVpBL2gfLuI9WSW1sR++zXP+zFhmen\n"
+"-----END CERTIFICATE-----\n"
+/* iot.oniudra.cc:8885 */
+"-----BEGIN CERTIFICATE-----\n"
+"MIIBzzCCAXagAwIBAgIUI5fEitwlnwujc/mU0d8LnDiDXBIwCgYIKoZIzj0EAwIw\n"
+"RTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkFyZHVpbm8gTExDIFVTMQswCQYDVQQL\n"
+"EwJJVDEQMA4GA1UEAxMHQXJkdWlubzAgFw0yNTAxMDgxMTA4MzdaGA8yMDU1MDEw\n"
+"MTExMDgzN1owRTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkFyZHVpbm8gTExDIFVT\n"
+"MQswCQYDVQQLEwJJVDEQMA4GA1UEAxMHQXJkdWlubzBZMBMGByqGSM49AgEGCCqG\n"
+"SM49AwEHA0IABBFwNODDPgC9C1kDmKBbawtQ31FmTudAXVpGSOUwcDX582z820cD\n"
+"eIaCwOxghmI+p/CpOH63f5F6h23ErqZMBkijQjBAMA8GA1UdEwEB/wQFMAMBAf8w\n"
+"DgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBQdnBmQGLB7ls/r1Tetdp+MVMqxfTAK\n"
+"BggqhkjOPQQDAgNHADBEAiBPSZ9HpF7MuFoK4Jsz//PHILQuHM4WmRopQR9ysSs0\n"
+"HAIgNadMPgxv01dy59kCgzehgKzmKdTF0rG1SniYqnkLqPA=\n"
 "-----END CERTIFICATE-----\n";
 #else
 
diff --git a/src/tls/utility/TLSClientMqtt.cpp b/src/tls/utility/TLSClientMqtt.cpp
index b96a83ca1..9bd8607a4 100644
--- a/src/tls/utility/TLSClientMqtt.cpp
+++ b/src/tls/utility/TLSClientMqtt.cpp
@@ -62,11 +62,7 @@ void TLSClientMqtt::begin(ConnectionHandler & connection) {
   /* Temporary force CACert to add new CA without rebuilding firmware */
   setCACert(AIoTSSCert);
 #elif defined(ARDUINO_ARCH_ESP32)
-  #if (ESP_ARDUINO_VERSION < ESP_ARDUINO_VERSION_VAL(3, 0, 4))
-    setCACertBundle(x509_crt_bundle);
-  #else
-    setCACertBundle(x509_crt_bundle, sizeof(x509_crt_bundle));
-  #endif
+  setCACert(AIoTUPCert);
 #elif defined(ARDUINO_ARCH_ESP8266)
   setInsecure();
 #endif
diff --git a/src/tls/utility/TLSClientOta.cpp b/src/tls/utility/TLSClientOta.cpp
index f03af7696..6ba0d0331 100644
--- a/src/tls/utility/TLSClientOta.cpp
+++ b/src/tls/utility/TLSClientOta.cpp
@@ -56,11 +56,7 @@ void TLSClientOta::begin(ConnectionHandler &connection) {
    */
   (void)connection;
 #elif defined(ARDUINO_ARCH_ESP32)
-  #if (ESP_ARDUINO_VERSION < ESP_ARDUINO_VERSION_VAL(3, 0, 4))
-    setCACertBundle(x509_crt_bundle);
-  #else
-    setCACertBundle(x509_crt_bundle, sizeof(x509_crt_bundle));
-  #endif
+  setCACert(AIoTUPCert);
 #elif defined(ARDUINO_ARCH_ESP8266)
   setInsecure();
 #endif

From ea3cd84efe2f279804004695b1f91b7314f4b15a Mon Sep 17 00:00:00 2001
From: Mattia Pennasilico <m.pennasilico@arduino.cc>
Date: Wed, 22 Jan 2025 10:43:40 +0100
Subject: [PATCH 09/10] Make default values const expressions

Co-authored-by: Andrea Gilardoni <4046444+andreagilardoni@users.noreply.github.com>
---
 src/ArduinoIoTCloudTCP.h | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/ArduinoIoTCloudTCP.h b/src/ArduinoIoTCloudTCP.h
index 7482ef8a9..f72709036 100644
--- a/src/ArduinoIoTCloudTCP.h
+++ b/src/ArduinoIoTCloudTCP.h
@@ -47,14 +47,14 @@
 /******************************************************************************
    CONSTANTS
  ******************************************************************************/
-static char const DEFAULT_BROKER_ADDRESS[] = "iot.arduino.cc";
-static uint16_t const DEFAULT_BROKER_PORT_SECURE_AUTH = 8885;
-static uint16_t const DEPRECATED_BROKER_PORT_SECURE_AUTH = 8883;
-static uint8_t const DEPRECATED_BROKER_AUTHORITY_KEY_IDENTIFIER[] = {
+static constexpr char DEFAULT_BROKER_ADDRESS[] = "iot.arduino.cc";
+static constexpr uint16_t DEFAULT_BROKER_PORT_SECURE_AUTH = 8885;
+static constexpr uint16_t DEPRECATED_BROKER_PORT_SECURE_AUTH = 8883;
+static constexpr uint8_t DEPRECATED_BROKER_AUTHORITY_KEY_IDENTIFIER[] = {
                   0x5b, 0x3e, 0x2a, 0x6b, 0x8e, 0xc9, 0xb0, 0x1a, 0xa8, 0x54,
                   0xe6, 0x36, 0x9b, 0x8c, 0x09, 0xf9, 0xfc, 0xe1, 0xb9, 0x80 };
-static uint16_t const DEFAULT_BROKER_PORT_USER_PASS_AUTH = 8884;
-static uint16_t const DEFAULT_BROKER_PORT_AUTO = 0;
+static constexpr uint16_t DEFAULT_BROKER_PORT_USER_PASS_AUTH = 8884;
+static constexpr uint16_t DEFAULT_BROKER_PORT_AUTO = 0;
 
 /******************************************************************************
  * TYPEDEF

From 88aedae55b648781af00beb526534ada00780143 Mon Sep 17 00:00:00 2001
From: pennam <m.pennasilico@arduino.cc>
Date: Wed, 22 Jan 2025 13:33:48 +0100
Subject: [PATCH 10/10] Rename _writeOnConnect into _writeCertOnConnect

---
 src/ArduinoIoTCloudTCP.cpp | 10 +++++-----
 src/ArduinoIoTCloudTCP.h   |  3 ++-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/ArduinoIoTCloudTCP.cpp b/src/ArduinoIoTCloudTCP.cpp
index 7f799b127..6956c3c45 100644
--- a/src/ArduinoIoTCloudTCP.cpp
+++ b/src/ArduinoIoTCloudTCP.cpp
@@ -60,7 +60,7 @@ ArduinoIoTCloudTCP::ArduinoIoTCloudTCP()
 , _password("")
 #endif
 #if defined(BOARD_HAS_SECURE_ELEMENT)
-, _writeOnConnect(false)
+, _writeCertOnConnect(false)
 #endif
 , _mqttClient{nullptr}
 , _messageTopicOut("")
@@ -114,7 +114,7 @@ int ArduinoIoTCloudTCP::begin(ConnectionHandler & connection, bool const enable_
       DEBUG_ERROR("ArduinoIoTCloudTCP::%s could not read device id.", __FUNCTION__);
       return 0;
     }
-    if (!_writeOnConnect) {
+    if (!_writeCertOnConnect) {
       /* No update pending read certificate stored in secure element */
       if (!SElementArduinoCloudCertificate::read(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
       {
@@ -289,12 +289,12 @@ ArduinoIoTCloudTCP::State ArduinoIoTCloudTCP::handle_ConnectMqttBroker()
 
 #if defined(BOARD_HAS_SECURE_ELEMENT)
     /* A device certificate update was pending */
-    if (_writeOnConnect)
+    if (_writeCertOnConnect)
     {
       if (SElementArduinoCloudCertificate::write(_selement, _cert, SElementArduinoCloudSlot::CompressedCertificate))
       {
         DEBUG_INFO("ArduinoIoTCloudTCP::%s device certificate update done.", __FUNCTION__);
-        _writeOnConnect = false;
+        _writeCertOnConnect = false;
       }
     }
 #endif
@@ -623,7 +623,7 @@ int ArduinoIoTCloudTCP::updateCertificate(String authorityKeyIdentifier, String
       DEBUG_INFO("ArduinoIoTCloudTCP::%s update done.", __FUNCTION__);
     }
 #else
-    _writeOnConnect = true;
+    _writeCertOnConnect = true;
 #endif
     return 1;
   }
diff --git a/src/ArduinoIoTCloudTCP.h b/src/ArduinoIoTCloudTCP.h
index f72709036..937d0d89d 100644
--- a/src/ArduinoIoTCloudTCP.h
+++ b/src/ArduinoIoTCloudTCP.h
@@ -150,7 +150,8 @@ class ArduinoIoTCloudTCP: public ArduinoIoTCloudClass
 #if defined(BOARD_HAS_SECURE_ELEMENT)
     SecureElement _selement;
     ECP256Certificate _cert;
-    bool _writeOnConnect;
+    /* Flag used to store updated device certificate after broker connection has succeeded */
+    bool _writeCertOnConnect;
 #endif
 
     TLSClientMqtt _brokerClient;