IoT Hub / DPS server certificate chain size: will it stay under 4 KB for constrained devices?

We run cellular sensors on the Nordic nRF9160. They connect over MQTT (port 8883) to Azure IoT Hub and provision through DPS, using X.509 device authentication. The TLS handshake runs inside the modem, and the modem only accepts a server certificate chain of at most 4 KB. This hardware limit cannot be changed in the field. If a chain grows beyond it, devices lose their connection and cannot be updated over the air.

This already happened with App Service. Since August 2026, *.azurewebsites.net serves a chain through Microsoft TLS G2 RSA CA OCSP → Microsoft TLS RSA Root G2 (cross-signed) → DigiCert Global Root G2, about 6.8 KB.

Current IoT Hub chains (measured 2026-10-15):

• RSA (default): leaf → MSFT RS256 CA-1 → DigiCert Global Root G2, about 3.0 KB
• ECC (ECDHE-ECDSA suites only): leaf → Microsoft TLS G2 ECC CA OCSP 06 → Microsoft TLS ECC Root G2 (cross-signed by DigiCert Global Root G3), about 3.6 KB
• DPS: RSA only. An ECDSA-only handshake fails.

Questions:

1. Is IoT Hub / DPS planned to move to the Microsoft TLS G2 RSA hierarchy (like App Service)? If so, when?
2. Will the IoT Hub ECC chain remain below 4 KB? Is the cross-signed root always included?
3. Is an ECC server certificate planned for DPS?
4. How much notice is given before the issuing CA or the chain structure changes, and where is it announced?
5. Is there a supported option for constrained devices to get a stable or bounded chain (for example a custom server certificate or domain)?