🛠 Client HTTPS/TLS et élément de sécurité ATECC608A

Objectives

Move from plain HTTP to TLS: query an API via HTTPS using WiFiSSLClient, understand certificate verification, and discover the ATECC608A-MAHDA-T, the encryption chip embedded on the GIGA R1 WiFi that serves as a hardware root of trust (secure key storage, authentication). This is the essential building block before MQTT/TLS (port 8883) or any serious cloud integration.

Hardware

• Arduino GIGA R1 WiFi board + u.FL antenna, WiFi 2.4 GHz WPA2
• "Arduino Giga R1" core up to date in IDE 2.x
• A test HTTPS API (for example https://example.org or your own server with a valid certificate)

Complete code

// GIGA R1 WiFi — requete HTTPS via WiFiSSLClient (TLS, port 443)
// NB : la disponibilite exacte de WiFiSSLClient selon le core (mbed ou Zephyr)
// doit etre verifiee dans le gestionnaire de bibliotheques — voir note ci-dessous.
#include <WiFi.h>
#include <WiFiSSLClient.h>

const char SSID[] = "your-ssid";
const char PASS[] = "your-pass";
const char API[]  = "example.org";

WiFiSSLClient secure;

void setup {
  Serial.begin(115200);
  while (!Serial) {}
  WiFi.begin(SSID, PASS);
  while (WiFi.status != WL_CONNECTED) { Serial.print("."); delay(200); }
  Serial.print("IP "); Serial.println(WiFi.localIP);

  Serial.print("Poignee TLS vers "); Serial.print(API); Serial.println(" : 443...");
  if (!secure.connect(API, 443)) {
    Serial.print("Echec TLS, code "); Serial.println(secure.state);
    while (true);                          // ne pas continuer en clair
  }
  Serial.println("Canal TLS etabli");

  secure.print("GET / HTTP/1.0\r\n");
  secure.print("Host: "); secure.println(API);
  secure.print("Connection: close\r\n\r\n");

  unsigned long debut = millis;
  while (secure.connected && millis - debut < 15000) {
    while (secure.available) Serial.write(secure.read);  // tout lire (#937)
  }
  secure.stop;
  Serial.println("\n--- reponse HTTPS recue ---");
  // La puce ATECC608A (racine de confiance materielle) peut stocker des cles
  // privees/certificats pour l'authentification client ; son acces passe par
  // les utilitaires du core, hors perimetre de ce sketch.
}

void loop { delay(10000); }

Expected verification

After "TLS channel established", the HTTP response encrypted in transit is displayed in plain text in the monitor (decryption takes place on the board). Disconnect the antenna or corrupt the SSID: the connection fails cleanly without ever falling back to HTTP. The TLS failure code helps distinguish a network problem from a certificate problem.

Common errors

• `> h supported by the manufacturer.
• Unsynced time: TLS requires a valid date; without a synchronized RTC (the board has an RTC and a VRTC pin for a backup battery), certificate date validation fails — synchronize the time (NTP) before any TLS handshake.
• Self-signed certificate refused: a Let's Encrypt server works, a homemade certificate does not; never disable verification in production.
• TLS/HTTPS confusion: TLS encrypts the channel; the HTTP on top remains in plain text within the channel. Always send the Host: header over HTTPS.
• Response body not drained: always the same rule #937 on the mbed core — read everything before stop.