Assignment 1: Establish and Verify a TLS Connection

Assignment 1: Establish and verify a TLS connection

#

In this assignment, you will run the ESP-IDF https_mbedtls example on the ESP32-S31-Function-CoreBoard-1: configure trust anchors, complete a TLS handshake to a public HTTPS server, and run controlled tests that should fail verification. Read Lecture 1 first for the threat model, API flow, and menuconfig paths.

Before you begin

#

Tools: you can follow every assignment from the command line (CLI) or from the CLion IDE.

Prepared project (recommended): use the complete Assignment 1 project from the workshop project setup. The steps below explain the supplied implementation and its verification.

For the manual cumulative route, start from $IDF_PATH/examples/protocols/https_mbedtls and carry the same project through later assignments.

cd assignment-1
idf.py --preview set-target esp32s31

idf.py --preview set-target esp32s31

Network: a Wi-Fi access point with internet access and outbound TCP port 443. The example connects to www.howsmyssl.com.

Step 1: Configure the trust anchor

#

Goal: enable the embedded CA bundle used by esp_crt_bundle_attach() (see Trust anchors and the certificate bundle in Lecture 1).

Open the project configuration:

idf.py menuconfig

idf.py menuconfig

Then:

1. Open Component config → mbedTLS → Certificate Bundle.
2. Enable Certificate Bundle (CONFIG_MBEDTLS_CERTIFICATE_BUNDLE).
3. Leave the default filter list bundle unless your instructor asks for the full Mozilla set (larger binary, broader coverage).
4. (Optional, for Step 3 untrusted-server tests) Set Custom Certificate Bundle Path to a folder with a lab CA PEM file: CONFIG_MBEDTLS_CUSTOM_CERTIFICATE_BUNDLE_PATH. Use .pem or .der extensions only, as documented in ESP x509 Certificate Bundle.
5. Open Serial flasher config → Flash size and select 4 MB.
6. Open Partition Table and select Single factory app (large), no OTA. This gives the application a 1.5 MB partition instead of the default 1 MB partition.

Save the configuration. Add these settings to sdkconfig.defaults in the project root so they survive a clean configuration:

CONFIG_ESPTOOLPY_FLASHSIZE_4MB=y
CONFIG_PARTITION_TABLE_SINGLE_APP_LARGE=y

Then build the project:

idf.py build

Confirm that the build reports the application fits in the 1.5 MB factory partition.

Step 2: Connect with server authentication

#

Goal: bring up the network and complete one successful HTTPS GET (see Network setup and Reference example architecture).

1. In the project configuration, open Example Connection Configuration.
2. Under Connect using, select Wi-Fi. Set the lab SSID and password (see protocols README).
3. Build, flash, and open the monitor:

idf.py -p PORT flash monitor

Success criteria (order may vary slightly):

• example_connect reports an IPv4 address on Wi-Fi
• Log lines similar to: Attaching the certificate bundle..., Performing the SSL/TLS handshake...
• esp-x509-crt-bundle: Certificate validated
• Certificate verified.
• A cipher suite line, for example Cipher suite is TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
• HTTP response body containing JSON from howsmyssl (TLS version and cipher list)

Capture a screenshot or log excerpt for your workshop notes. This is useful test evidence for protection in transit (see CRA relevance in Lecture 1).

Step 3: Test certificate validation

#

Goal: confirm that verification fails closed when trust or hostname is wrong (see Hostname and certificate verification).

Revert to a known-good tree or git stash between tests. Rebuild and flash after each change.

Document each test: what you changed, log output, and whether the device continued to reject the bad case after reboot.

Step 4: Add mutual TLS (optional)

#

The stock https_mbedtls example does not implement mTLS. This step is optional.

If your instructor assigns it:

1. Read One-way TLS vs mutual TLS in Lecture 1.
2. Follow ESP-IDF guidance for client certificates (for example ESP-TLS or mbedTLS mbedtls_ssl_conf_own_cert with PEM buffers embedded at build time).
3. Use demonstration client cert and key from your instructor. Store keys in encrypted NVS in real products (Lecture 2).

What you learned

#

You should now be able to:

• Enable the ESP-IDF certificate bundle and attach it with esp_crt_bundle_attach()
• Run https_mbedtls on ESP32-S31 over Wi-Fi via example_connect()
• Interpret success logs (Certificate validated, cipher suite, HTTP JSON response)
• Trigger and recognize verification failures (hostname, untrusted CA, optional expiry)
• Describe how monitor logs and test notes support a product trust store policy and CRA-oriented test evidence

Closing demo: TLS power consumption

#

After you finish the TLS exercises, the instructor will demonstrate TLS power consumption on the ESP32-S31-Function-CoreBoard-1 using a Qoitech Otii Ace Pro Power Profiler. You will observe the supply current during Wi-Fi startup and the TLS handshake while comparing plain HTTP, a full TLS handshake, and a resumed TLS session. No student wiring is required.

The measurements, results, and instructions for exploring the recordings are available in Power consumption measurement.

Previous and next steps

#

Previous: Lecture 1

Next: Power consumption measurement

Return to the workshop main page