I have a Raspberry Pi (4B) which I'm using as an access point. I want to connect multiple ESP32-microcrontrollers to the access point using WPS. So far so good. But after I've established the IP-connection, I want to switch to SSL/TLS encrypted communication using HTTPS and MQTTS.

Now: The ESP32 doesn't have root ssl certificates saved (like our webbrowser), so it has no way of determining if the server (the raspi) is legit. To circumvent this, the traditional way would have been to place a certificate within the flash memory of the SSL while flashing the device. However, this now has to happen dynamically, as the ESP32 doesn't know beforehand to which Access Point it will connect eventually. So the certificate has to be transmitted after establishing the IP-connection. And it has to happen safely, but how?

Additional information: The raspi is not only an access point but also a wifi station within a local network. So I use a self-signed certificate for the raspi, as I think it makes no sense to have it signed by a CA.

  • Have you considered using the BSSID in the ESP32-wifi-configs to just lock it to this very Pi as access point?
    – FelixJN
    Dec 16, 2020 at 10:01
  • I need to clarify that: I don't want to lock it to a specific Pi. Quite the contrary actually: It might happen often that the ESP32 does change its access point from one Pi to the next. Each time that happens, a new certificate has to be sent to the esp to establish secure connection to the new AP.
    – glades
    Dec 16, 2020 at 10:55
  • Think you would be best to ask on the IoT exchange or look at RADIUS services for secure connection. Neither are Pi related hence my close vote.
    – user115418
    Dec 28, 2020 at 0:16


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.