How to Acquire the Root CA Certificate

If you need the most up-to-date certificates for test sites such as www.howsmyssl.com or www.httpbin.org, please scroll to the bottom of this article. However, I strongly recommend reading through the article so you can learn how to acquire the certificates yourself. This is a very useful skill.

Welcome to AvantMaker.com, your go-to resource for empowering makers, learners, and enthusiasts in DIY, AI, IoT, Smart Home, and STEM projects.

This guide provides detailed instructions on acquiring the Root CA certificate for www.howsmyssl.com, a demonstration site often used in secure connection examples for the ESP32 microcontroller. When establishing a secure TLS connection with an ESP32, obtaining the server’s Root CA certificate is essential for verifying the server’s identity. Follow these steps to retrieve the certificate using Microsoft Edge.

Note: Root CA certificates have expiration dates. To ensure your ESP32 projects maintain secure and functional connections, periodically check and update the certificate as needed to keep it current.

Step-by-Step Guide

Open Microsoft Edge and Navigate to the Site
Launch Microsoft Edge on your computer. In the address bar, type https://www.howsmyssl.com and press Enter. Ensure the URL begins with https:// to establish a secure connection.
Access the Security Information
Once the page loads, locate the padlock icon to the left of the URL in the address bar. Click the padlock icon to open the security details dropdown. This icon indicates that the connection is secure and encrypted.
View the Certificate
In the dropdown menu, click on “Connection is secure” to expand the security information. Then, select “Certificate is valid” or a similar option (the wording may vary slightly depending on your Edge version). This opens the Certificate window.
Navigate to the Certification Path
In the Certificate window, click the “Certification Path” tab. This tab displays the certificate hierarchy, including the server’s certificate, any intermediate certificates, and the Root CA certificate at the top of the chain.
Select the Root CA Certificate
In the Certification Path, locate and highlight the topmost certificate, which is the Root CA certificate (e.g., “ISRG Root X1” issued by the Internet Security Research Group, used by Let’s Encrypt). This is the certificate you need for your ESP32 project.
View Root CA Certificate Details
With the Root CA certificate selected, click the “View Certificate” button. This opens a new Certificate window displaying the details of the Root CA certificate, including its validity period and issuer information.
Export the Certificate
In the Root CA Certificate window, switch to the “Details” tab. Click the “Copy to File…” button to launch the Certificate Export Wizard. Click “Next” to proceed.
Choose Export Format
In the Certificate Export Wizard, select the format “Base-64 encoded X.509 (.CER)”. This format is compatible with ESP32 programming environments like the Arduino IDE. Click “Next”.
Specify a File Location
Click “Browse” to choose a location on your computer to save the certificate (e.g., your Desktop or a project folder). Name the file something descriptive, such as howsmyssl_root_ca.cer, and click “Save”. Then, click “Next”.
Complete the Export
Review the export settings in the Wizard, then click “Finish”. A confirmation message will appear stating “The export was successful.” Click “OK” to close the dialog.
Convert to ESP32-Compatible Format
Open the exported .cer file in a text editor (e.g., Notepad or VS Code). The contents will be in PEM format, enclosed between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. Copy this text, including the BEGIN and END lines, into your ESP32 code (e.g., as a const char* variable). Ensure it is enclosed in a raw literal (e.g., R"literal(...)") if using Arduino IDE.

Using the Certificate in Your ESP32 Project

Once you have the Root CA certificate, integrate it into your ESP32 code to establish a secure connection to www.howsmyssl.com. This certificate allows the ESP32 to verify the server’s identity during the TLS handshake, ensuring a secure and trusted connection for your IoT projects. Visit AvantMaker.com for sample code and tutorials on implementing secure connections with ESP32.

Reminder: The Root CA certificate for www.howsmyssl.com (e.g., issued by Let’s Encrypt) expires periodically. Check the expiration date in the certificate details and update it in your project as needed to avoid connection failures.

Root CA Certificate for www.howsmyssl.com

Root CA Certificate for www.httpbin.org