Provisioning the CoAP CA certificate on the nRF9151 DK

The nRF9151 DK does not ship with the nRF Cloud CoAP root CA in the developer security tag, so you need to install it once.

Save the nRF Cloud CoAP root CA certificate to a file named coap_ca.pem. The certificate is maintained in the ca_certs.py file in the nRF Cloud utils repository. Copy the value of the nrf_cloud_coap_ca variable, including the BEGIN CERTIFICATE and END CERTIFICATE lines.

[!NOTE] Only the CoAP root CA is needed. The AWS root CA in the same file is used for MQTT, REST, and HTTP file downloads, none of which the template uses.

Install nrfcredstore:

pip3 install -r nrf/scripts/requirements-extra.txt

Disconnect from the network before writing credentials. Credential storage only succeeds when the modem is offline. In the device shell, run:
```
uart:~$ att_network disconnect
```
Then close the serial terminal so nrfcredstore can open the UART exclusively for credential writing.
Write the certificate to security tag 2147483667:
```
nrfcredstore <serial port> write 2147483667 ROOT_CA_CERT coap_ca.pem
```
The tool autodetects whether the device exposes a raw AT interface or the AT shell. If autodetection fails, force the interface used by the template with nrfcredstore --cmd-type shell <serial port> write ....

Verify that the certificate is in place:

nrfcredstore <serial port> list --tag 2147483667
Secure tag   Key type           SHA
2147483667   ROOT_CA_CERT       XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

A ROOT_CA_CERT entry for security tag 2147483667 means the root CA is stored and the DTLS handshake can be verified against it.