🛠 HTTPS avec validation de certificat racine

Objectives

Move from plain HTTP to HTTPS using WiFiSSLClient: the TLS handshake is handled by the NINA module, which verifies the server certificate against its internal store of root CAs (bundle rebuilt from the Android list, embedded by the nina-fw firmware). You will learn how to diagnose validation failures and cope with known TLS bugs in the firmware.

Hardware

• 1 × Arduino MKR WiFi 1010 (WiFi operational, see STA tutorial)
• Up-to-date NINA firmware (non-negotiable prerequisite for TLS)
• A public HTTPS test host (e.g., www.howsmyssl.com)
• The embedded crypto chip ATECC508 exists on the board, but the standard TLS path in WiFiNINA runs on the NINA module

Complete code

#include <WiFiNINA.h>

const char* SSID = "votre-ssid";
const char* PASS = "votre-mot-de-passe";
WiFiSSLClient secure;   // TLS + validation CA embarquee dans le NINA

void setup {
  Serial.begin(115200);
  WiFi.begin(SSID, PASS);
  while (WiFi.status != WL_CONNECTED) { delay(500); Serial.print("."); }

  if (secure.connect("www.howsmyssl.com", 443)) {
    secure.println("GET /a/check HTTP/1.1");
    secure.println("Host: www.howsmyssl.com");
    secure.println("Connection: close");
    secure.println;
    while (secure.available) Serial.write(secure.read);
    secure.stop;                       // libere la session TLS
  } else {
    Serial.println("Handshake TLS KO - firmware/CA a verifier");
  }
}

void loop {}

Expected verification

The JSON response from howsmyssl is displayed, proving that the channel is encrypted and the certificate is validated. secure.connect returns 0 as long as the issuing CA is not in the module's bundle: update the firmware first before suspecting your code. Always call stop: each TLS session consumes the NINA's precious RAM.

Common errors

• Memory leak on repeated TLS connections: nina-fw issues #135/#136 describe downloadAndSaveFile reporting success after a certificate initialization failure and leaking heap memory on every TLS operation (identical in 3.0.1 and master at the time of the reports; fix in PR #149). In production, space out reconnections, call stop, and plan for a reset watchdog.
• New site "refused" although valid: recent CA missing from the firmware bundle — prioritize updating the firmware over using a custom setCertificate.
• Confusing DNS failure, TCP failure, and TLS failure: first test WiFiClient on port 443 to isolate the network layer.
• Self-signed certificates: you must extract the root CA in PEM format and declare it explicitly; the intermediate server certificate alone is not sufficient.