esp-idf/examples/protocols/https_server/simple/main/certs/README.md

# Certificate Generation Guide

This directory contains certificates for the HTTPS server example. This guide explains how to generate new server and client certificates signed by the existing CA certificate.

## Prerequisites

- OpenSSL installed on your system
- Existing CA certificate (`cacert.pem`) and CA private key (`cakey.pem`)
- Configuration files for certificate extensions (`server_cert.conf` and `client_cert.conf`)

## Generating Server Certificate

Follow these steps to create a new server certificate signed by the CA:

### 1. Generate Server Private Key

```bash
openssl genpkey -algorithm RSA -out new_server.key -pkeyopt rsa_keygen_bits:2048
```

This creates a 2048-bit RSA private key for the server.

### 2. Create Certificate Signing Request (CSR)

```bash
openssl req -new -key new_server.key -out new_server.csr -config server_cert.conf
```

This generates a CSR using the server's private key and the configuration specified in `server_cert.conf`.

### 3. Sign the Server Certificate with CA

```bash
openssl x509 -req -in new_server.csr -CA cacert.pem -CAkey cakey.pem -CAcreateserial -out new_server.pem -days 3650 -extensions v3_req -extfile server_cert.conf
```

This creates the server certificate (`new_server.pem`) valid for 10 years (3650 days), signed by the CA certificate.

## Generating Client Certificate

Follow these steps to create a new client certificate signed by the CA:

### 4. Generate Client Private Key

```bash
openssl genpkey -algorithm RSA -out new_client.key -pkeyopt rsa_keygen_bits:2048
```

This creates a 2048-bit RSA private key for the client.

### 5. Create Certificate Signing Request (CSR)

```bash
openssl req -new -key new_client.key -out new_client.csr -config client_cert.conf
```

This generates a CSR using the client's private key and the configuration specified in `client_cert.conf`.

### 6. Sign the Client Certificate with CA

```bash
openssl x509 -req -in new_client.csr -CA cacert.pem -CAkey cakey.pem -CAcreateserial -out new_client.pem -days 3650 -extensions v3_req -extfile client_cert.conf
```

This creates the client certificate (`new_client.pem`) valid for 10 years (3650 days), signed by the CA certificate.

## Installing the Certificates

### 7. Copy Certificates to Expected Locations

```bash
cp new_server.pem servercert.pem && \
cp new_server.key prvtkey.pem && \
cp new_client.pem client_cert.pem && \
cp new_client.key client_key.pem
```

This copies the newly generated certificates and keys to the filenames expected by the example application.

## File Naming Convention

The example application expects the following files:

- `servercert.pem` - Server certificate
- `prvtkey.pem` - Server private key
- `client_cert.pem` - Client certificate
- `client_key.pem` - Client private key
- `cacert.pem` - CA certificate (for verification)

## Security Notes

⚠️ **Important Security Considerations:**

- The private keys (`prvtkey.pem`, `client_key.pem`, `cakey.pem`) should be kept secure. As these are for demonstration purposes, they are included here, but in a production environment, ensure they are stored securely and access is restricted.
- The certificates in this example directory are for **demonstration purposes only**
- For production use, generate new certificates with appropriate security parameters
- Consider using shorter validity periods for production certificates
- Store private keys with restricted file permissions (e.g., `chmod 600`)

## Verifying Generated Certificates

You can verify the generated certificates using:

```bash
# Verify server certificate
openssl x509 -in servercert.pem -text -noout

# Verify client certificate
openssl x509 -in client_cert.pem -text -noout

# Verify certificate chain
openssl verify -CAfile cacert.pem servercert.pem
openssl verify -CAfile cacert.pem client_cert.pem
```

## Troubleshooting

- If certificate verification fails, ensure the CA certificate and key are valid and match
- Check that the configuration files (`server_cert.conf`, `client_cert.conf`) contain appropriate Subject Alternative Names (SANs) and extensions
- Ensure OpenSSL version is up to date for best compatibility