Case and Problem: I have an esp32 board and reading through arduino's site, I don't see any streamlined ways of setting up a secure web server. I did see ways to securely connect to a remote host but did not see an effective way to make your host a secure one that can be connected to.
Context: I want to make an interface I can connect to from a browser, and I wanted to go the route of using a self signed cert on the client device so if that one cert was compromised, the only device that'd be impacted is the microcontroller vs something like a password auth that if intercepted may compromise a number of other accounts and devices based on a user's habit.
Objective: I want to prevent unauthorized access to the microcontroller, and wouldn't mind a slight delay in authentication since I would (should) be the only one that's sending traffic/making requests.
Question: Do we have some streamlined template/sketch/workflow for securing our microcontroller-hosted web servers yet? Ideally I'd like a solution that revolves around certificates but I'm open to other effective methodologies. The important thing to me is that the solution is one that can be understood rather than one that is just to be trusted.
I've seen in both the arduino and esp32 examples for a simple web server and can't bring myself to feel comfortable typing the line
and leaving it at that. As tempting as it sounds to see what packet injection looks like on my own infrastructure through some tests on HTTP or even just a simple POST, I'd like to avoid maintaining any bad habits.
Further reading on the topic though it doesn't do much to explain how things work: ESP32_ssl_webserver