Security
Secure TLS connections on the ESP8266
In our previous post, Securing the Internet of Things, we introduced SSL/TLS support for the Arduino MKR1000. This time we are working with the well-known ESP8266, and yes, it also supports secure TLS connections to our Internet of Things platform.
From the archive: written in October 2016, when Arduino library 2.5.0 made TLS the default on the ESP8266. Today the ESP8266 is still one of the boards of the Arduino client, and TLS runs on every transport of the platform: see Security and the 2025 post on IoT platform security.
This little device, thanks to the community support, now integrates TLS support by software. In our tests we have not noticed any significant performance issues, and the connections seem to be as stable as always. So we have decided that ESP8266 devices will connect by default using secure sockets. Update the Arduino libraries to 2.5.0 to start using this security feature.
Debug output
Check that the connection is secured
If you enable the debug output in your ESP8266 sketch, you will see how the device now connects by default using secure connections.
We have improved the debug output to actually detect whether the connection is secured or not:
[NETWORK] Connecting to network Meeble [NETWORK] Connected to WiFi! [NETWORK] Getting IP Address... [NETWORK] Got IP Address: 192.168.1.101 [NETWORK] Connected! [_SOCKET] Connecting to iot.thinger.io:25202... [_SOCKET] Using secure TLS/SSL connection: yes [_SOCKET] SSL/TLS Host Verification Succeed! [_SOCKET] Connected! [THINGER] Authenticating. User: alvarolb Device: nodemcu [THINGER] Writing bytes: 35 [OK] [THINGER] Authenticated
Using secure TLS/SSL connection: yes
Opting out
Disabling TLS on a device
If the security of your device is not a concern, you can easily disable the TLS/SSL connection.
Include the following define before any include:
#define _DISABLE_TLS_ // add the includes here
Hope you enjoy your secure devices!
How the platform is secured today
Encrypted transports, per-device credentials and mutual TLS, under an ISO 27001 certified management system.
