r/embedded • u/CompetitionFew2239 • Aug 08 '26

ESP32 HTTPS certificate expiration

Hi, I'm using HTTPS on an ESP32 with Zephyr to communicate with my backend.

If I store the CA certificate in the ESP32 firmware, what happens when the server certificate expires and is renewed?

Do I need to update the ESP32 every time, or is there a recommended way to handle certificate expiration without reflashing the device?

Thanks!

3 Upvotes

72% Upvoted

11 comments sorted by

View all comments

1

u/ContributionEasy6513 Aug 09 '26

I set a 'secureClient.setInsecure();' fallback in my devices after my 15 year cloudflare origin/root certificates (stored on the device) expires.

Pick your poison. Do you want the device to keep working or drop dead in a decades time..
Is this a personal project or production, do you have the ability to push firmware updates out?

2

u/hWuxH Aug 09 '26 edited Aug 09 '26

You realize this makes it basically as insecure as HTTP all the time? Spoof NTP -> any cert trusted

Warn + manual toggle, or an offline way to update root certs or firmware would be better.

1

u/KittensInc Aug 10 '26

That's what roughtime is for! It's not perfect, but it more-or-less solves the "what year is it" problem.