TLS Config Skill

TLS certificate configuration: test certificates, production setup, backend selection (OpenSSL vs MbedTLS), and Let's Encrypt.

Invoke with: /tls-config

Pre-Built Test Certificates

The ioto/certs/dist/ directory provides ready-to-use test certificates:

File	Description
ca.crt, ca.key	Certificate Authority (signs test.crt)
test.crt, test.key	CA-signed server certificate
self.crt, self.key	Self-signed certificate
ec.crt, ec.key	Elliptic curve certificate (prime256v1)
aws.crt	AWS IoT root CA

These are for development only — never use in production.

TLS Configuration

{
    tls: {
        authority: '@certs/roots.crt',
        certificate: '@certs/test.crt',
        key: '@certs/test.key',
    },
}

Generating Test Certificates

make -C ioto/certs                   # Generate all test certs
make -C ioto/certs self-signed-cert  # Self-signed certificate
make -C ioto/certs test-cert         # CA-signed test certificate
make -C ioto/certs ec-cert           # Elliptic curve certificate
make -C ioto/certs cert-request      # Generate CSR for external CA
make -C ioto/certs BITS=4096 DAYS=365  # Custom key size and validity

Production Certificates

Let's Encrypt (Recommended)

certbot certonly --standalone -d your-device.example.com

{
    tls: {
        authority: '/etc/letsencrypt/live/your-device.example.com/chain.pem',
        certificate: '/etc/letsencrypt/live/your-device.example.com/fullchain.pem',
        key: '/etc/letsencrypt/live/your-device.example.com/privkey.pem',
    },
}

External CA

Use make -C ioto/certs cert-request to generate a CSR, submit to your CA, then install the signed certificate.

TLS Backend Selection

# OpenSSL (default, recommended for desktop/server)
ME_COM_OPENSSL=1 ME_COM_MBEDTLS=0 make

# MbedTLS (recommended for ESP32 and constrained devices)
ME_COM_MBEDTLS=1 ME_COM_OPENSSL=0 make

Backend	Best For	Notes
OpenSSL	Linux, macOS, servers	Full feature set, required for OpenAI
MbedTLS	ESP32, FreeRTOS, constrained	Smaller footprint, embedded-friendly

Web Server HTTPS

{
    web: {
        endpoints: [
            { address: ':443' },
            { address: ':80' },
        ],
    }
}

MQTT TLS

{
    mqtt: {
        authority: '@certs/aws.crt',
    },
}