alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-10-05 20:47:46 -04:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

docs(security): add section about managing the root certificates

Browse Source
This commit is contained in:
Mahavir Jain 2023-10-24 18:57:28 +05:30
parent ac97c61d1a
commit 64cb35deef
No known key found for this signature in database
GPG Key ID: 99324EF4A00734E0
1 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
docs/en/security/security.rst
View File

@ -177,6 +177,23 @@ UART Download Mode
It is highly recommended to verify the identity of the server based on X.509 certificates to avoid establishing communication with the **fake** server.
Managing Root Certificates
^^^^^^^^^^^^^^^^^^^^^^^^^^
Root Certificates embedded inside the application must be managed carefully. Any update to the root certificate list or the :doc:`../api-reference/protocols/esp_crt_bundle` can have an impact on the TLS connection with the remote endpoint. This includes a connection to the OTA update server. In some cases, the problem shall be visible on the next OTA update and it may leave device unable to perform OTA updates forever.
Root certificates list update could have following reasons:
- New firmware has different set of remote endpoint(s).
- Existing certificate has expired.
- The certificate has been added or retracted from the upstream certificate bundle.
- The certificate list changed due to market share statistics (``CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN`` case).
Some guidelines to consider on this topic:
- Please consider enabling :ref:`OTA rollback <ota_rollback>` and then keep the successful connection to the OTA update server as the checkpoint to cancel the rollback process. This ensures that the newly updated firmware can successfully reach till the OTA update server, otherwise rollback process will go back to the previous firmware on the device.
- If you plan to enable the :ref:`CONFIG_MBEDTLS_HAVE_TIME_DATE` option then please consider to have sufficient number of trusted certificates and the time sync mechanism (SNTP) in place.
Product Security
----------------