Step 5: Connect to nRF Cloud

The host connects to nRF Cloud with its own certificate and private key. You create a certificate authority (CA) once, use it to install credentials on the device, and register the device in your nRF Cloud project.

Run the following commands from a normal terminal, not the toolchain shell. The credential installer uses the console port, so close the serial terminal on VCOM0 first.

Install the nRF Cloud command-line tools (once per computer):
```
pip3 install nrfcloud-utils "memfault-cli>=1.12.0"
```
Create a self-signed CA certificate (once, reuse it for all your devices). Replace US with your two-letter country code:
```
create_ca_cert -c US -f self_
```
This creates self_<serial>_ca.pem, self_<serial>_prv.pem, and self_<serial>_pub.pem. Keep the CA private key safe.
Install the device credentials on the host. Replace <device_id> with the Device ID from step 4.3, and <console_port> with the VCOM0 port:
```
device_credentials_installer \
  --ca self_<serial>_ca.pem \
  --ca-key self_<serial>_prv.pem \
  --id-str <device_id> \
  -s -d --verify --coap --local-cert --cmd-type tls_cred_shell \
  --port <console_port>
```
On success, it saves an onboarding file named onboard.csv. The command also saves the device certificate and private key as PEM files in the current directory. Delete the device private key file afterwards.
Register the device in your nRF Cloud project, as described in the device onboarding quickstart. In the nRF Cloud dashboard, create an Organization Auth Token under Admin > Organization Auth Tokens, and copy the organization and project slugs from Project Settings > General. Then run:
```
nrfcloud --org-token <org_auth_token> --org <org_slug> --project <project_slug> \
  device create --csv onboard.csv
```
The command prints <device_id>: OK when nRF Cloud has created the device.
Open the serial terminal on VCOM0 again.

Checkpoint: The cloud module retries every 10 seconds, so within a few seconds the log shows the following:

<inf> main: Cloud connected

If the CA certificate or private key is missing, each attempt logs what is missing instead and retries until you install the credentials:

<wrn> cloud: Missing nRF Cloud credentials (see the application documentation)
<wrn> cloud:   - CA cert (run device_credentials_installer --coap)

If the connection is refused, check that you onboarded the host Device ID from the boot log, not the modem UUID, and re-run nrfcloud device create.