I'm reading very different things about certificates in IoT. I'm struggling to make a choice on how to manage this.

Here's the situation:

  • I'm using ESP32
  • I don't have much storage available
  • I need to send data to a server through HTTPS
  • I need to receive data from this same server
  • I'm using Let's Encrypt on server's side
  • I can do OTA updates but I'd like to avoid it the most possible

Edit :

  • I need server authentication
  • I don't need client authentication

Which certificate do I have to embed into ESP32?

1 Answer 1


You've not said if you want to do client authentication via certificate as well as the usual server validation.

Assuming just server validation then you need to include the Certificate Authority chain to be able to validate the certificate presented by the HTTP server. In this case it would the Lets Encrypt chain which is available from here: https://letsencrypt.org/certificates/

You will need either the ISRG Root cert and the matching signed intermediate certificate or the the IdenTrust Root CA cert and the matching intermediate. Personally I would pick the first option.

If you want to do client authentication as well then you will need to generate certificates and private keys for each device and include these as well.

  • I just need to do server authentication. How to deal with certificates expiration?
    – Aliz
    Apr 4, 2019 at 12:10
  • The CA chain certificates have very long lifetimes (the intermediate expires on Oct 6 15:43:55 2021 GMT) it's unlikely to be a problem and if it is then you can do a OTA update.
    – hardillb
    Apr 4, 2019 at 12:12
  • Ok but what if OTA update doesn't work or if we are too late to update? How to prevent the system not being able to perform HTTPS requests anymore?
    – Aliz
    Apr 4, 2019 at 12:17
  • 2
    No, but they will publish the new Intermediate cert well ahead of them switching to it and you will need to include both intermediate certs in a OTA update. This is exactly how ALL CAs work. Please read up on how CA's work.
    – hardillb
    Apr 4, 2019 at 12:41
  • 1
    That doesn't matter because by the time the intermediate cert expires the server cert will no longer be signed with it so it will fail
    – hardillb
    Jul 23, 2019 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.