Skip to main content
Version: Next

Configure Certificates

TLS and DTLS servers (and mTLS clients) need X.509 certificates, private keys, and often a trust store. NoxTLS provides parsing, verification, and TLS integration through the Certificates API.

Tools you will use​

ToolPurpose
Cert utility (cert)Parse, convert, verify, inspect keys
Certificate appHigher-level cert operations
CertgenGeneration (when enabled in your build)

Build apps with BUILD_APPLICATIONS=ON (default in Quickstart).

Inspect a certificate​

./binary/cert info -i device.crt
./binary/cert read -i device.der

Human-readable summary includes subject, issuer, validity, and public key type.

Convert PEM ↔ DER​

Embedded firmware often stores DER; developers edit PEM on the host.

# DER to PEM
./binary/cert convert -i cert.der -o cert.pem -f pem

# PEM to DER
./binary/cert convert -i cert.pem -o cert.der -f der

Explicit input/output formats (also supported by the noxtls CLI cert subcommand):

noxtls cert convert -i cert.der -I der -o cert.pem -O pem

Verify a chain​

./binary/cert verify -i chain.pem

For TLS connections, verification also happens during the handshake when you configure trust anchors and hostname checks in the TLS context — do not rely on the utility alone in production.

Private keys​

Inspect key material (handle carefully — protect files on disk):

./binary/cert keyinfo -i server.key
./binary/cert keywrite -i key.der -o key.pem -f pem

Supported key types depend on your build profile (RSA, ECDSA, Ed25519, etc.). Server profile example:

cmake -S . -B build -D NOXTLS_PROFILE=tls_server_pki -D BUILD_TESTS=OFF

Typical device layouts​

StoreContentsFormat
Device certEnd-entity certificateDER in flash
Private keyServer or client keyDER or protected secure element
Trust storeRoot / intermediate CAsOne or more DER certs

Keep flash usage small by storing only required intermediates, not entire public CT logs.

TLS integration checklist​

  1. Parse DER/PEM into NoxTLS cert structures (or use pre-parsed blobs from your manufacturing flow).
  2. Configure server — attach cert + key to tls13_context_t / accept path.
  3. Configure client trust — load CA for server authentication; optional client cert for mTLS.
  4. SNI and names — set server name on clients; ensure certificate SAN/CN matches.
  5. Time — validity checks require a trustworthy clock (or disable time checks only in test builds via NOXTLS_HAVE_TIME — see Configuration Guide).

Post-quantum signatures (optional)​

With NOXTLS_CFG_FEATURE_ML_DSA=ON, ML-DSA keys and TLS 1.3 signature schemes are available. See TLS 1.3 PQC and ML-DSA API.

Local HTTPS example​

Combine with Build Your First HTTPS Server:

openssl req -x509 -newkey rsa:2048 -keyout server.key -out server.crt -days 365 -nodes -subj "/CN=localhost"
./binary/https_server 8443 --cert server.crt --key server.key

Next steps​