🛠 HTTPS : client TLS et certificats de confiance

Objectives

Move from plain HTTP to HTTPS: encrypt the client's TLS session using a trusted certificate authority stored in flash, verify the server chain, and understand the role of the RP2350's hardware SHA-256 accelerator and TRNG. This is the security building block for any connected object on the Pico 2 W.

Hardware

• Pico 2 W connected to Wi-Fi
• pico-sdk with pico_cyw43_arch_lwip_threadbackground (lwIP + mbedTLS)
• Root certificate bundle (ISRG Root X1, Let's Encrypt...) to embed

Complete Code

// main.c - inspire de pico-examples pico_w/wifi/tls_client
#include "pico/stdlib.h"
#include "pico/cyw43_arch.h"
#include "mbedtls/platform.h"
#include "mbedtls/net_sockets.h"
#include "mbedtls/ssl.h"

extern const uint8_t ca_cert_pem_start[];   // bundle CA compile en flash
extern const uint8_t ca_cert_pem_end[];

int main(void) {
    stdio_init_all;
    if (cyw43_arch_init) { return 1; }
    cyw43_arch_enable_sta_mode;
    if (cyw43_arch_wifi_connect_timeout_ms(
            "mon_ssid", "mon_mot_de_passe", CYW43_AUTH_WPA2_AES_PSK, 30000)) {
        return 1;
    }
    mbedtls_ssl_context ssl; mbedtls_ssl_init(&ssl);
    mbedtls_ssl_config cfg;  mbedtls_ssl_config_init(&cfg);
    mbedtls_x509_crt ca;     mbedtls_x509_crt_init(&ca);
    // 1) mbedtls_x509_crt_parse(&ca, ca_cert_pem_start, taille)
    // 2) mbedtls_ssl_config_defaults + conf_ca_chain(&cfg, &ca, NULL)
    // 3) mbedtls_ssl_set_hostname(&ssl, "api.exemple.fr")
    // 4) handshake puis mbedtls_ssl_write/read sur le port 443
    printf("TLS en place\n");
    while (true) { sleep_ms(1000); }
}

In MicroPython: ssl.wrap_socket(s, server_hostname=hote) with the CA passed as ca=.

Expected Verification

The handshake succeeds on port 443 and the request receives a 200 response; with a missing CA or an incorrect hostname, mbedtls_ssl_handshake returns -0x2700 (certificate not trusted) instead of 0.

Common Errors

• Forgetting mbedtls_ssl_set_hostname: name verification fails even with a valid certificate.
• Embedding a CA bundle that is too large: flash is 4 MB, but the 520 KB RAM limits the number of CAs loaded into memory.
• Confusing the root CA with the intermediate certificate: only the root must be provided.
• Incorrect system date: without NTP, certificates will appear expired; synchronize the time first.