I have a Raspberry Pi (4B) which I'm using as an access point. I want to connect multiple ESP32-microcrontrollers to the access point using WPS. So far so good. But after I've established the IP-connection, I want to switch to SSL/TLS encrypted communication using HTTPS and MQTTS.
Now: The ESP32 doesn't have root ssl certificates saved (like our webbrowser), so it has no way of determining if the server (the raspi) is legit. To circumvent this, the traditional way would have been to place a certificate within the flash memory of the SSL while flashing the device. However, this now has to happen dynamically, as the ESP32 doesn't know beforehand to which Access Point it will connect eventually. So the certificate has to be transmitted after establishing the IP-connection. And it has to happen safely, but how?
Additional information: The raspi is not only an access point but also a wifi station within a local network. So I use a self-signed certificate for the raspi, as I think it makes no sense to have it signed by a CA.