esp-secure-cert-mgr-skill

Generates ESP-IDF firmware code for reading, writing, and verifying esp_secure_cert partition credentials.

28|3|Updated Jun 24, 2026
One-click install
npx skills add https://github.com/JasonYANG170/esp-dev-skill --skill esp-secure-cert-mgr-skill-jasonyang170
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: esp-secure-cert-mgr-skill
Source: https://github.com/JasonYANG170/esp-dev-skill/tree/main/repos/esp_secure_cert_mgr
Command: npx skills add https://github.com/JasonYANG170/esp-dev-skill --skill esp-secure-cert-mgr-skill-jasonyang170

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Developing firmware against the Espressif esp_secure_cert_mgr component is error-prone: APIs are conditionally compiled by Kconfig and SoC capabilities, read pointers must be paired with free calls, writes require prior erase and IDF >= 5.3, and partition tables need exact formats. This Skill grounds AI-generated code in the real repository headers, docs, and examples so no APIs are invented. ## Core Features & Use Cases - 10 scenario recipes: reading device/CA certificates and private keys, DS peripheral signing, ECDSA peripheral (eFuse key) signing, TLV iteration, runtime TLV writes, HMAC-derived ECDSA keys, buffer-mode image generation, integrity/signature verification, fail-safe partition OTA, and configure_esp_secure_cert.py usage. - Reference docs: full API reference grouped by module, Kconfig/SoC capability/partitions.csv configuration reference, categorized pitfalls, and an index of real example projects. - Use Case: You need to load a pre-provisioned device certificate and DS context into an esp-tls connection on an ESP32-C3. The Skill routes you to the DS recipe, gives the exact get_ds_ctx/free_ds_ctx call chain, and validates Kconfig and partitions.csv before generating code. ## Quick Start Ask the AI to read the device certificate and private key from the esp_secure_cert partition and use them in an esp-tls HTTPS connection on ESP32-C3.

Frequently Asked Questions about esp-secure-cert-mgr-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I read the device certificate from the esp_secure_cert partition?

Call esp_secure_cert_get_device_cert() from esp_secure_cert_read.h, which returns the subtype 0 device certificate pointer and length. Always pair it with esp_secure_cert_free_device_cert(), since NVS or HMAC-encrypted configurations allocate memory dynamically.

How do I use the DS peripheral with esp_secure_cert_mgr?

Enable CONFIG_ESP_SECURE_CERT_DS_PERIPHERAL on a chip with SOC_DIG_SIGN_SUPPORTED, then call esp_secure_cert_get_ds_ctx() to obtain the esp_ds_data_ctx_t for TLS or PSA signing. Note that get_priv_key is compiled out when DS is enabled, and you must call esp_secure_cert_free_ds_ctx() afterward.

Why does esp_secure_cert_append_tlv return FLASH_NOT_ERASED?

Flash write mode defaults to check_erase=true, and flash can only change bits from 1 to 0. Call esp_secure_cert_erase_partition() before appending TLVs, and back up the partition first on production devices because erase is irreversible.

Does esp_secure_cert_mgr support writing credentials at runtime?

Yes, but only with ESP-IDF 5.3 or newer, which defines ESP_SECURE_CERT_WRITE_SUPPORT and exposes esp_secure_cert_write.h APIs. On older IDF versions the write functions are unavailable, so guard calls with the macro or upgrade IDF.

What partitions.csv format does the esp_secure_cert partition need?

The default TLV format uses the line: esp_secure_cert, 0x3F, , 0xD000, 0x2000, encrypted (8 KiB). Legacy cust_flash and nvs formats use 0x6000 size and require CONFIG_ESP_SECURE_CERT_SUPPORT_LEGACY_FORMATS; omitting the encrypted flag breaks reads when flash encryption is on.

When should I not use esp_secure_cert_mgr?

It only applies to ESP-IDF projects using the esp_secure_cert partition for pre-provisioned credentials. It does not cover non-ESP-IDF platforms, general mbedTLS/TLS usage unrelated to that partition, or overall factory eFuse burning strategy design.