Hi Adriano,Adriano wrote: ↑Thu Aug 29, 2019 3:27 pmI don't know if it is a good solution, but I am developing it in this way:
1. load certificate from SPIFFS.
2. connect to HTTPS_WEBPAGE.
3. if it fails, I connect to HTTP_WEBPAGE/cer.php to download the new certificate.
4. save the new certificate in the SPIFFS.
5. reboot ESP32
It is simple to create a php script for retrieving the certificate. You just need a server able to answer also without https.
I'm glad this works for you, but from a security perspective you might as well disable HTTPS certificate checking in the client - if an attacker can MITM the HTTPS connection then they can force step (3) to execute, and force the device to download a new certificate that they provide. (Note that HTTPS without certificate checking is still better than HTTP, as it protects against passive listeners - but it can't protect against an active attacker who can MITM.)
Instead, suggest configuring the client to trust the root certificate used by LetsEncrypt, instead of the device certificate. Root certificate expiry should be very long, so you can plan for this in advance (my LetsEncrypt web server uses "ISRG Root X1" which is valid until 4 June 2035).
You still need to plan for the possibility that LetsEncrypt will change root cert providers, but you can do this by (a) storing some alternative root certs in the device just in case and (b) keeping backups of your old LetsEncrypt certificate chains so if necessary you can keep using an old cert for long enough to have the device download or OTA update to use a newer root cert, which you then start using.
We have another plan for making this whole process easier in ESP-IDF (root certificate management) but unfortunately we don't have an ETA for that support.