LwM2M Security Configuration Rejected — Complete Guide

In this tutorial, you'll learn about LwM2M Security Configuration Rejected. We cover key concepts, practical examples, and best practices.

The Problem

LwM2M Security Object (ID 0) configuration is rejected by the client.

Quick Fix

Wrong

// Security object with no credentials
anjay_security_add_instance(anjay, 0, true,
  "coap://server:5683", false, NULL);```

Security instance created but no credentials. Unencrypted connection.

### Right

```cpp
#include <anjay/anjay.h>
#include <anjay/security.h>

int main(void) {
  anjay_t *anjay = anjay_new(&config);
  anjay_security_object_install(anjay);

  // Security Instance 0: DTLS with PSK
  const anjay_security_config_t psk_config = {
    .uri = "coaps://lwm2m-server:5684",
    .bootstrap_server = false,
    .security_mode = ANJAY_SECURITY_PSK,
    .public_identity = (const uint8_t*)"client-identity",
    .public_identity_size = 16,
    .secret_key = (const uint8_t*)"secret-psk-key",
    .secret_key_size = 13,
    .short_server_id = 1
  };
  anjay_security_add_instance_ex(anjay, &psk_config);

  // Instance 1: DTLS with certificate (RPK)
  const anjay_security_config_t rpk_config = {
    .uri = "coaps://bs-server:5784",
    .bootstrap_server = true,
    .security_mode = ANJAY_SECURITY_RPK,
    .public_identity = cert_identity,
    .secret_key = cert_private_key,
    .short_server_id = 0
  };
  anjay_security_add_instance_ex(anjay, &rpk_config);

  anjay_start(anjay);
}```

Client connects to bootstrap server using RPK, then registers with main server using PSK.

## Prevention

LwM2M Security Object (ID 0) stores server credentials. Security modes: NoSec (plain CoAP), PSK (Pre-Shared Key), RPK (Raw Public Key), Certificate (X.509). Each server instance needs: Server URI, Security Mode, Client Identity/Key, Short Server ID. Bootstrap server uses the same object but is flagged with Bootstrap_server = true.

DodaTech engineers apply these same patterns across Doda Browser, DodaZIP, and Durga Antivirus Pro for production IoT reliability.

## FAQ

<details style="margin-bottom:12px;border:1px solid #e2e8f0;border-radius:10px;overflow:hidden"><summary style="cursor:pointer;padding:14px 18px;font-weight:600;font-size:1.05rem;background:#f8fafc;border-bottom:1px solid #e2e8f0;color:#1e293b">### What security modes are available?</summary><div style="padding:14px 18px;color:#475569;line-height:1.7;background:#fff"><p>NoSec = plain CoAP/UDP. PSK = Pre-Shared Key (symmetric). RPK = Raw Public Key (asymmetric, no CA). Certificate = X.509 with CA chain.</p>
<h3 id="psk-vs-certificate">PSK vs Certificate?</h3><p>PSK: simpler, single shared key, less CPU. Certificate: stronger, requires CA infra, more CPU. RPK is a middle ground (public key without CA).</p>
<h3 id="what-is-the-bootstrap-security-instance">What is the bootstrap security instance?</h3><p>A separate Security Instance with Bootstrap_server=true. Used to provision the main server credentials. Typically uses RPK or Certificate.</p>
</div></details>