Approaches to Provision ESP32 devices with AWS IOT Security Certificates for your product.

We will go over the ways to install certificates on ESP32 and give you the ways we recommend our clients.

ESP32 downloads certificates from the cloud

We rule this option out due following drawbacks

1. File handling with limited ESP32 resources is tedious
2. Takes up valuable flash space which could be used by the application firmware.
3. Out of production line, connecting every device to Wi-Fi is time consuming.

Mobile App provisions the device on first use

The approach

1. The device advertises over BLE
2. The mobile app connects to the device
3. The app downloads and installs the certificates
4. The app also configures the Wi-Fi credentials and connects the device to AWS IOT

Pros
For a consumer facing product with an accompanying Mobile App, this is a very good choice for the following reasons.

1. Integrating AWS IOT device provisioning workflows on mobile app is relatively easier.
2. The first use of the device by end user can be authenticated via mobile app
3. Other product configuration or customization can be done along with the provisioning process
4. Makes product deployments across geographies easier.

Cons

1. The app development has additional BLE Integration

Assembly line provisioning

Approach

Build a manufacturing support tool (MST) that runs on the computer. It performs the following tasks.

1. Integrate AWS IOT provisioning APIs in the MST
2. The MST connects to internet and downloads the certificates and flashes via USB or Serial port

Pros:

1. Improves end user experience with least steps
2. Provisioning happens straight out of the production line

Cons:

1. Ensuring security at the assembly line is important, the MST should ensure that.
2. The device will need internet connection on the assembly line.

The accompanying mobile app is the solution that we recommend. How are you accomplishing the ESP32 AWS-IOT provisioning?