Blog
ESP32 Security: Encryption, Secure Boot, Certificates
Can you get a virus by plugging in an esp32? How to secure an esp32 wireless device — the security questions people ask before shipping a device, answered without the fearmongering.
Can You Get a Virus by Plugging in an ESP32?
Practically no — an ESP32 enumerates as a plain serial port, so it has no path to run anything on your computer. It cannot drop files or type keystrokes. A hostile hand-built board could in theory abuse a vulnerable USB stack, but that is implant territory, not a normal seller’s board.
How to Secure an ESP32 Wireless Device?
A five-point baseline: unique credentials, TLS on every connection, no open debug console, current firmware, outbound-only traffic. The full how to secure an esp32 wireless device drill: password-gate the UART console in production, and watch Espressif’s security advisories. What to skip depends on what the device does — a desk prototype can ignore half of this. Wi-Fi hardening: the Wi-Fi security FAQ.
How to SSH into ESP32?
There is no real SSH server for the ESP32 — it runs an RTOS, not a Unix userland, so no sshd. Closest options: a raw TCP shell with a password gate, or ser2net on a Pi bridging the serial console over the network. Most people want remote access, not literally SSH — MQTT with TLS is the more maintainable answer.
How to Generate Certificate for ESP32?
One openssl command gives a self-signed pair: openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes. That is how to generate certificate for esp32 server-side TLS in one line. Embed the PEMs in your sketch or store them in NVS. Let’s Encrypt works publicly, but renewing on an MCU is a chore — most projects use a long-lived private CA cert.
How to Get Root Certificate for ESP32?
Easiest path: call esp_crt_bundle_attach() and the device trusts the Mozilla root store, so public servers validate out of the box. To get root certificate for esp32 from a private CA, export your CA’s PEM and pass it as the CA buffer. Self-signed servers put their own cert in the trust store.
How to Get the Peer Certificate from a TLS Server?
The peer certificate is reachable through the esp_tls connection object during the handshake, or via mbedTLS callbacks if you need it earlier. Searching for this usually means pinning your own server — compare a stored SHA-256 of the expected cert.
Should You Enable Secure Boot and Flash Encryption?
Only if someone can physically take your device and dump the flash. Secure Boot and flash encryption burn one-way eFuses; after that, every OTA image must be signed, and losing the key bricks every unit in the field. For a hobby build, real friction; for a product holding keys, the difference between trivial and hard extraction.
How Much Does TLS Cost on an ESP32?
About one to two seconds per handshake and 40–60 KB of flash on an original ESP32; 300–500 ms on the S3 and C3. I measured ~1.3 s on a WROOM-32 to a local MQTT broker — fine for keepalive traffic, too slow for per-request HTTPS on battery. More failure modes: the debugging article.
Can I Keep API Keys Safe in Firmware?
No — anything in flash is readable with esptool.py read_flash 0x0 0x400000 backup.bin, and I have pulled my own builds apart that way. Obfuscation only slows casual readers. Real options: keep secrets server-side, or a hardware key on an ATECC608. The flashing guide shows the command.
Is It Safe to Expose an ESP32 to the Internet?
Direct exposure is risky; prefer outbound connections to an MQTT broker with TLS and per-device credentials. If you must forward a port: random long password, no telnet console, current firmware. Bridge-heavy setups — a Pi or cloud relay — remove most of the attack surface.
Security Starts With Not Phoning Home
The local-first pattern this FAQ keeps pointing at is runnable: an HTTP server on the chip itself — device UI on your LAN, no cloud in the middle. Pair with Wi-Fi connect to see the join from the device side. For secure-boot and flash-encryption specifics, hardware remains the honest venue; for architecture and traffic shape, the browser is enough.