I'm reading very different things about certificates in IoT. I'm struggling to make a choice on how to manage this.

Here's the situation:

  • I'm using ESP32
  • I don't have much storage available
  • I need to send data to a server through HTTPS
  • I need to receive data from this same server
  • I'm using Let's Encrypt on server's side
  • I can do OTA updates but I'd like to avoid it the most possible

Edit :

  • I need server authentication
  • I don't need client authentication

Which certificate do I have to embed into ESP32?


You've not said if you want to do client authentication via certificate as well as the usual server validation.

Assuming just server validation then you need to include the Certificate Authority chain to be able to validate the certificate presented by the HTTP server. In this case it would the Lets Encrypt chain which is available from here: https://letsencrypt.org/certificates/

You will need either the ISRG Root cert and the matching signed intermediate certificate or the the IdenTrust Root CA cert and the matching intermediate. Personally I would pick the first option.

If you want to do client authentication as well then you will need to generate certificates and private keys for each device and include these as well.

| improve this answer | |
  • I just need to do server authentication. How to deal with certificates expiration? – Aliz Apr 4 '19 at 12:10
  • The CA chain certificates have very long lifetimes (the intermediate expires on Oct 6 15:43:55 2021 GMT) it's unlikely to be a problem and if it is then you can do a OTA update. – hardillb Apr 4 '19 at 12:12
  • Ok but what if OTA update doesn't work or if we are too late to update? How to prevent the system not being able to perform HTTPS requests anymore? – Aliz Apr 4 '19 at 12:17
  • You can't, if you can't update the certs then it will stop working – hardillb Apr 4 '19 at 12:21
  • 1
    No, but they will publish the new Intermediate cert well ahead of them switching to it and you will need to include both intermediate certs in a OTA update. This is exactly how ALL CAs work. Please read up on how CA's work. – hardillb Apr 4 '19 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.