user_settings.h for Arduino and ESP32-S2

[BojanJurca]

Hi, I've got both https server and client running on Arduino and ESP32-WROOM, but I keep getting error when calling wolfSSL_CTX_use_certificate_buffer when compiling the same code for Arduino and ESP32-S2. curl reports curl: (35) schannel: failed to receive handshake, SSL/TLS connection failed.

Could you please suggest which user_settings.h to use for ESP32-S2?

[BojanJurca]

I guess I should mention how I generate self-signed elliptic-curve key and certificate as well:

    "C:\Program Files\OpenSSL-Win64\bin\openssl" req ^
    -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 ^
    -days 3650 -nodes -x509 ^
    -subj "/C=SI/ST=Slovenia/L=Ljubljana/O=ESP32/CN=jurca.dyn.ts.si" ^
    -keyout server-key.pem ^
    -out server-cert.pem

    "C:\Program Files\OpenSSL-Win64\bin\openssl" ec ^
    -in server-key.pem ^
    -outform DER ^
    -out server-key.der

[kareem-wolfssl]

Hi @BojanJurca,

I would recommend our Arduino user_settings.h: https://github.com/wolfSSL/wolfssl/tree/master/IDE/ARDUINO
I suspect you are running out of memory on your ESP32-S2, but I will need debug logs to confirm. Please enable debug logging by defining:

#define DEBUG_WOLFSSL
#define WOLFSSL_DEBUG_CERTIFICATE_LOADS
#define WOLFSSL_DEBUG_TRACE_ERROR_CODES
#define WOLFSSL_LOGGINGENABLED_DEFAULT 1

and attach a debug log here.

[BojanJurca]

I added the #definitions in user_settings.h and in setup () turned wolfSSL_Debugging_ON (); Then I changed debug level to Verbose.

It seems that doing all this doesn't leave enough RAM even for WiFi to start working.

I can see that the max contiguous memory block is 28 KB though.

What I can do is display the error code after wolfSSL_CTX_use_certificate_buffer read: err = wolfSSL_get_error(nullptr, 0);
which gives -173. I have checked that the certificate is correctly loaded into the buffer.

[BojanJurca]

I'm getting the same error even when I give wolfSSL_CTX_use_certificate_buffer 22 KB of memory (running it in a separate task).

[BojanJurca]

With a lot of help from Gemini and after many tries and errors I've got HTTPS server working on ESP32-S2 as well with user_settings.h:

/* --------------------------------------------------------------------------

	WolfSSL user_settings.h example file

	This WolfSSL user_settings.h configuration is optimized for ESP32-WROOM 
	modules without PSRAM and is suitable for TLS certificates and keys based
	on elliptic curves (ECC), especially secp256r1. 

	It enables the required ECC features, disables unsupported curves 
	(Curve25519/Ed25519), and minimizes RAM usage through static memory allocation.

	The configuration is ideal for HTTPS, WSS, MQTT‑TLS, and other secure IoT 
	applications running on ESP32 with Arduino Core or ESP-IDF.

	--------------------------------------------------------------------------

	CreateSelfSignedCertificateAndKey.cmd example file

	@echo off
	REM ---------------------------------------------------------------------------
	REM  Example: Generate an ECC-based self-signed TLS certificate for ESP32
	REM  This script creates:
	REM     - ECC private key (prime256v1 / secp256r1)
	REM     - Self-signed X.509 certificate (PEM)
	REM     - DER-encoded key and certificate (required by many ESP32 libraries)
	REM
	REM  Curve prime256v1 (secp256r1) is recommended for ESP32 because:
	REM     - It is fast
	REM     - Uses minimal RAM
	REM     - Fully supported by WolfSSL and mbedTLS
	REM ---------------------------------------------------------------------------


	REM ---------------------------------------------------------------------------
	REM 1) Generate a new ECC private key + self-signed certificate (PEM format)
	REM    -newkey ec                     → create a new elliptic-curve key
	REM    -pkeyopt ec_paramgen_curve:prime256v1 → use secp256r1 curve
	REM    -x509                          → output a self-signed certificate
	REM    -nodes                         → do not encrypt the private key
	REM    -days 3650                     → certificate validity (10 years)
	REM    -subj                          → certificate subject fields
	REM ---------------------------------------------------------------------------

	"C:\Program Files\OpenSSL-Win64\bin\openssl" req ^
	-new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 ^
	-days 3650 -nodes -x509 ^
	-subj "/C=SI/ST=Slovenia/L=Ljubljana/O=ESP32/CN=jurca.dyn.ts.si" ^
	-keyout server-key.pem ^
	-out server-cert.pem


	REM ---------------------------------------------------------------------------
	REM 2) Convert the ECC private key from PEM → DER
	REM    ESP32/WolfSSL often require DER format for embedded TLS
	REM ---------------------------------------------------------------------------

	"C:\Program Files\OpenSSL-Win64\bin\openssl" ec ^
	-in server-key.pem ^
	-outform DER ^
	-out server-key.der


	REM ---------------------------------------------------------------------------
	REM 3) Convert the certificate from PEM → DER
	REM    DER is a compact binary format suitable for microcontrollers
	REM ---------------------------------------------------------------------------

	"C:\Program Files\OpenSSL-Win64\bin\openssl" x509 ^
	-in server-cert.pem ^
	-outform DER ^
	-out server-cert.der


	REM ---------------------------------------------------------------------------
	REM  Done!
	REM  You now have:
	REM     server-key.pem   → ECC private key (PEM)
	REM     server-cert.pem  → Self-signed certificate (PEM)
	REM     server-key.der   → ECC private key (DER)
	REM     server-cert.der  → Certificate (DER)
	REM
	REM  These files are ready for use with ESP32 HTTPS/TLS servers.
	REM ---------------------------------------------------------------------------

	echo ECC certificate and key generation completed successfully.
	pause

   -------------------------------------------------------------------------- */

#include <sdkconfig.h>

#if CONFIG_IDF_TARGET_ESP32 // for ESP32 WROOM ----------------------------------------------



			#ifndef WOLFSSL_USER_SETTINGS_H
			#define WOLFSSL_USER_SETTINGS_H


			/* --------------------------------------------------------------------------
			   PLATFORM DEFINITIONS
			   -------------------------------------------------------------------------- */

			/* Tell WolfSSL that we are running on ESP32 */
			#define WOLFSSL_ESP32

			/* Optimize for the ESP32-WROOM module */
			#define WOLFSSL_ESP32_WROOM

			/* FreeRTOS is the underlying scheduler */
			#define FREERTOS

			/* Arduino framework compatibility (ESP32 Arduino Core) */
			#define WOLFSSL_ARDUINO


			/* --------------------------------------------------------------------------
			   HARDWARE CRYPTO ACCELERATION
			   -------------------------------------------------------------------------- */

			/*
			   ESP32 provides hardware acceleration for AES, SHA, RSA, etc.
			   However, the SHA hardware engine may conflict with Arduino SHA libraries.
			   If you encounter SHA-related compile errors, keep this define enabled.
			*/
			// #define WOLFSSL_ESP32_CRYPT
			#define NO_WOLFSSL_ESP32_CRYPT_HASH


			/* --------------------------------------------------------------------------
			   TLS VERSION AND CRYPTOGRAPHY
			   -------------------------------------------------------------------------- */

			/*
			   TLS 1.3 is faster and better suited for multitasking environments.
			*/
			#define WOLFSSL_TLS13

			/* Required algorithms for TLS 1.3 */
			#define HAVE_AESGCM
			#define HAVE_HKDF
			#define HAVE_FFDHE_2048

			/* RSA-PSS support (required for RSA certificates in TLS 1.3) */
			#define WC_RSA_PSS
			#define HAVE_HMAC
			#define HAVE_TLS_EXTENSIONS
			#define HAVE_SUPPORTED_CURVES



			/* --------------------------------------------------------------------------
			   MEMORY OPTIMIZATION (for devices without PSRAM)
			   -------------------------------------------------------------------------- */

			/*
			   Static memory reduces fragmentation and improves stability
			   on systems with limited RAM.
			*/
			#define WOLFSSL_STATIC_MEMORY

			/* Faster big‑integer math implementation */
			#define USE_FAST_MATH

			/* Protection against timing attacks */
			#define TFM_TIMING_RESISTANT


			/* --------------------------------------------------------------------------
			   REMOVE UNUSED FEATURES (smaller binary size)
			   -------------------------------------------------------------------------- */

			/* Disable old TLS versions (TLS 1.0 / TLS 1.1) */
			#define NO_OLD_TLS

			/* Disable PSK authentication (not used in most IoT devices) */
			#define NO_PSK

			/* Remove obsolete hash algorithms */
			#define NO_MD4

			/* Remove password‑based key derivation (not needed here) */
			#define NO_PWDBASED

			/* Disable SNI if not required */
			#define NO_SNI


			/* --------------------------------------------------------------------------
			   OVERRIDE: Switch TLS 1.3 → TLS 1.2
			   -------------------------------------------------------------------------- */

			/*
			   Example of overriding previous settings.
			   If you need TLS 1.2 for compatibility with older clients,
			   simply undefine TLS 1.3 and enable TLS 1.2.
			*/
			// #undef WOLFSSL_TLS13
			// #define WOLFSSL_TLS12



			/* --------------------------------------------------------------------------
			   REQUIRED: Tell WolfSSL to use this user_settings.h
			   -------------------------------------------------------------------------- */
			#define WOLFSSL_USER_SETTINGS

			#endif /* WOLFSSL_USER_SETTINGS_H */



#elif CONFIG_IDF_TARGET_ESP32S2 // for ESP32-S2 ---------------------------------------------



			/* ==========================================================================
			   WOLFSSL ARDUINO USER SETTINGS FOR ESP32-S2 (ECC DER 500-bytes Certificate)
			   Reported for Issue: https://github.com
			   ========================================================================== */

			#ifndef WOLFSSL_USER_SETTINGS_H
			#define WOLFSSL_USER_SETTINGS_H

			/* Platform Configuration */
			#define WOLFSSL_ARDUINO
			#define WOLFSSL_ESP32
			#define FREERTOS

			/* Disable hardware crypto engines to avoid ESP32-S2 register conflicts */
			#define NO_WOLFSSL_ESP32_CRYPT_HASH

			/* Elliptic Curve Cryptography (ECC) Settings */
			#define HAVE_ECC                 /* Enables internal ecc.c compilation */
			#define HAVE_SUPPORTED_CURVES    /* Required for TLS curves extensions */
			#define HAVE_TLS_EXTENSIONS      /* Required for TLS extensions */
			#define HAVE_ECDH                /* Required for ECC key exchange */
			#define HAVE_ECC256              /* Limit to SECP256R1 (prime256v1) only to save RAM/Flash */
			#define WOLFSSL_SHA256           /* Required for certificate signature verification */


			/* Memory Optimizations for low Heap environments (ESP32-S2 without PSRAM) */
			#define USE_FAST_MATH
			#define TFM_TIMING_RESISTANT
			/// #define WOLFSSL_LOW_MEMORY       /* Compute on the fly, disable lookup tables */
			#define SINGLE_THREADED          /* Disable internal mutexes/semaphores to shrink structures */
			#define NO_SESSION_CACHE         /* Do not cache sessions to maximize free Heap */
			#define WOLFSSL_DYNAMIC_BUFFERS  /* Release I/O buffers immediately after packets travel */
			#define ALT_ECC_SIZE             /* Dynamic size structures for ECC points */
			#define NO_ERROR_STRINGS         /* Strip large text error codes to save Flash/RAM */

			/* Strict Tuning Bounds */
			#undef FP_MAX_BITS
			#define FP_MAX_BITS 1024         /* Required size to avoid ASN buffer error -173 during DER parse */

			#undef RECORD_SIZE
			#define RECORD_SIZE 1024         /* Force maximum 1KB TLS record payload sizes to prevent malloc overflow */

			#endif /* WOLFSSL_USER_SETTINGS_H */



#endif // -----------------------------------------------------------------------------------

I'm still working on an HTTPS client.