esp-idf/examples/protocols/https_server/simple/main/certs

Certificate Generation Guide

This directory contains certificates for the HTTPS server example. This guide explains how to generate new server and client certificates signed by the existing CA certificate.

Prerequisites

• OpenSSL installed on your system
• Existing CA certificate (cacert.pem) and CA private key (cakey.pem)
• Configuration files for certificate extensions (server_cert.conf and client_cert.conf)

Generating Server Certificate

Follow these steps to create a new server certificate signed by the CA:

1. Generate Server Private Key

openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048

This creates a 2048-bit RSA private key for the server.

2. Create Certificate Signing Request (CSR)

openssl req -new -key new_server.key -out new_server.csr -config server_cert.conf

This generates a CSR using the server's private key and the configuration specified in server_cert.conf.

3. Sign the Server Certificate with CA

openssl x509 -req -in new_server.csr -CA cacert.pem -CAkey cakey.pem -CAcreateserial -out new_server.pem -days 3650 -extensions v3_req -extfile server_cert.conf

This creates the server certificate (new_server.pem) valid for 10 years (3650 days), signed by the CA certificate.

Generating Client Certificate

Follow these steps to create a new client certificate signed by the CA:

4. Generate Client Private Key

openssl genpkey -algorithm RSA -out new_client.key -pkeyopt rsa_keygen_bits:2048

This creates a 2048-bit RSA private key for the client.

5. Create Certificate Signing Request (CSR)

openssl req -new -key new_client.key -out new_client.csr -config client_cert.conf

This generates a CSR using the client's private key and the configuration specified in client_cert.conf.

6. Sign the Client Certificate with CA

openssl x509 -req -in new_client.csr -CA cacert.pem -CAkey cakey.pem -CAcreateserial -out new_client.pem -days 3650 -extensions v3_req -extfile client_cert.conf

This creates the client certificate (new_client.pem) valid for 10 years (3650 days), signed by the CA certificate.

Installing the Certificates

7. Copy Certificates to Expected Locations

cp new_server.pem servercert.pem && \
cp new_server.key prvtkey.pem && \
cp new_client.pem client_cert.pem && \
cp new_client.key client_key.pem

This copies the newly generated certificates and keys to the filenames expected by the example application.

File Naming Convention

The example application expects the following files:

• servercert.pem - Server certificate
• prvtkey.pem - Server private key
• client_cert.pem - Client certificate
• client_key.pem - Client private key
• cacert.pem - CA certificate (for verification)

Security Notes

⚠️ Important Security Considerations:

• The private keys (prvtkey.pem, client_key.pem, cakey.pem) should be kept secure. As these are for demonstration purposes, they are included here, but in a production environment, ensure they are stored securely and access is restricted.
• The certificates in this example directory are for demonstration purposes only
• For production use, generate new certificates with appropriate security parameters
• Consider using shorter validity periods for production certificates
• Store private keys with restricted file permissions (e.g., chmod 600)

Verifying Generated Certificates

You can verify the generated certificates using:

# Verify server certificate
openssl x509 -in servercert.pem -text -noout

# Verify client certificate
openssl x509 -in client_cert.pem -text -noout

# Verify certificate chain
openssl verify -CAfile cacert.pem servercert.pem
openssl verify -CAfile cacert.pem client_cert.pem

Troubleshooting

• If certificate verification fails, ensure the CA certificate and key are valid and match
• Check that the configuration files (server_cert.conf, client_cert.conf) contain appropriate Subject Alternative Names (SANs) and extensions
• Ensure OpenSSL version is up to date for best compatibility