How to implement multi-certificate management for ESP devices?

• Set a specific partition to store certificate files
• Multiple certificate file management
• Certificate format conversion
• Download the certificate to Flash
• Use the corresponding certificate file

---

1. Set a specific partition to store certificate files

Define the certificate file partition in the project partition table file, as follows:

• As above, the converted certificate.bindownload address is0x41000
• The size of the certificate firmware is 300 KB, it is necessary to ensure that the partitions do not overlap, and the size of the bin file meets the Flash Size setting

---

2. Multi-certificate file management

• Create a customized folder under the customer project
• Create a certificate folder and certificate.csv file in the customized folder directory
• Various certificate files are stored under certificatethe folder, for example server_ca.crt, server_cert.crt,server.key
• certificate.csvUnder File , specify the file paths for various certificates in the following format:

key,type,encoding,value
server_cert,namespace,,
server_cert,file,binary,E:\esp\test\customized\server_cert\server_cert.crt
server_key,namespace,,
server_key,file,binary,E:\esp\test\customized\server_key\server.key
server_ca,namespace,,
server_ca,file,binary,E:\esp\test\customized\server_ca\server_ca.crt

For supported file types to be managed, see: CSV file format description.

• Different storage types need to set differentEncoding
  

---

3. Certificate format conversion

• Use the script tool under the esp-idf/components/nvs_flash/nvs_partition_generator filenvs_partition_gen.py
  

E:\esp\test\customized\certificate.csvConvert the file to certificate.binthe format

For instructions on using the NVS script tool, see "NVS Partition Generator"

The command is:

python nvs_partition_gen.py generate E:\esp\test\customized\certificate.csv certificate.bin 0x4B000

0x4B000is the converted bin file size

---

4. Download the certificate to Flash

As the partition table is set above, the converted certificate.bindownload address is 0x41000, and you can directly use the Flash download tool to download certificate.binthe file

• If you need to replace a new certificate file, you only need to replace the certificate file under the corresponding E:\esp\test\customized\certificatefolder , and then use nvs_partition_gen.pythe script tool to convert the certificate file format into bin firmware
• There is no need to put the new certificate under the project and recompile the project to obtain the certificate firmware (bin file)

---

5. Use the corresponding certificate file

When the certificate file needs to be used in the application, use the nvs_open_from_partition API to obtain the certificate file, and the corresponding parameters are set as follows: