Micro-controlleurs

Setting up HTTPS (Optional)

This may be optional, but if the connection between the ESP8266 and the server is over the Internet it is highly recommended to use some encryption.

Unfortunately, you can’t just go ahead and use something like Let’s Encrypt for obtaining a certificate. That is because at least at the time of the writing, the HTTP client library for the ESP8266 still requires the fingerprint of the certificate to be provided as a second argument when calling the http.begin(). This means that if you use something like Let’s Encrypt, you’ll have to reflash the firmware to the chip every 3 months in order to update the certificate fingerprint after each renewal.

A way around that, would be to generate a self-signed certificate that expires after a very long time (e.g. 10 years) and keep the logging script on its own virtual host with its own subdomain. That way, you can have the web interface for accessing the data on a separate subdomain, that will use a proper certificate from a trusted authority. The usage of a self-signed certificate in this case is not a security issue, as the fingerprint of the certificate which uniquely identifies it will be hardcoded into the firmware and the certificate is only going to be used by the ESP8266. 

Before we start, I will assume that you already own a domain name and you're able to create subdomains on it. So, to generate a certificate that expires after 10 years run the following command and answer the questions.

sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/ssl/private/sensors.key -out /etc/ssl/certs/sensors.crt

As this is a self-signed certificate what you answer in most questions doesn't matter too much, except for the question that asks for the Common Name. This is where you'll need to provide the full subdomain that is going to be used for this virtual host. The subdomain you'll give here will need to be the same with the ServerName that you'll set later in your virtual host configuration.

Next create a new virtual host configuration,

sudo nano /etc/apache2/sites-available/sensors-ssl.conf

with the following contents,

<VirtualHost *:443>
	ServerName [subdomain]
	DocumentRoot /var/www/sensors

	SSLEngine ON
	SSLCertificateKeyFile /etc/ssl/private/sensors.key
	SSLCertificateFile /etc/ssl/certs/sensors.crt

	<Directory /var/www/sensors/>
		Options +FollowSymlinks -Indexes
		AllowOverride All
	</Directory>

	ErrorLog ${APACHE_LOG_DIR}/sensors-error-ssl.log
	CustomLog ${APACHE_LOG_DIR}/sensors-access-ssl.log combined
</VirtualHost>

Again, be sure to replace the [subdomain] with the same subdomain that you used with the certificate. At this point you will need to disable the default virtual host of Apache,

sudo a2dissite 000-default

change the name of the document root directory,

sudo mv /var/www/html /var/www/sensors

and finally enable the new virtual host and restart Apache,

sudo a2ensite sensors-ssl
sudo systemctl restart apache2

Last thing that needs to be done is to obtain the fingerprint of the certificate, because you'll need to use it in the firmware code.

openssl x509 -noout -fingerprint -sha1 -inform pem -in /etc/ssl/certs/sensors.crt

The http.begin() expects the delimiters between the bytes of the fingerprint to be spaces, so you’ll need to replace the colons with spaces before using it in your code.

Now, if you don’t want to use a self-signed certificate for the web interface setup a new subdomain and create a new virtual host configuration,

sudo nano /etc/apache2/sites-available/sensors-web-ssl.conf

with the following contents,

<VirtualHost *:443>
	ServerName [subdomain]
	DocumentRoot /var/www/sensors
	#SSLEngine ON
	#SSLCertificateFile /etc/letsencrypt/live/[subdomain]/cert.pem
	#SSLCertificateKeyFile /etc/letsencrypt/live/[subdomain]/privkey.pem
	#SSLCertificateChainFile /etc/letsencrypt/live/[subdomain]/chain.pem

	<Directory /var/www/sensors/>
		Options +FollowSymlinks -Indexes
		AllowOverride All
	</Directory>
	ErrorLog ${APACHE_LOG_DIR}/sensors-web-error-ssl.log
	CustomLog ${APACHE_LOG_DIR}/sensors-web-access-ssl.log combined
</VirtualHost>

Be sure to replace the [subdomain] with the subdomain that you have setup for the web interface. Next enable the new virtual host, restart Apache, install certbot and obtain a certificate for the new subdomain from Let's Encrypt,

sudo a2ensite sensors-web-ssl
sudo systemctl restart apache2
sudo apt update
sudo apt install certbot
sudo certbot certonly --apache -d [subdomain]

After obtaining the certificate edit the virtual host configuration again to uncomment the SSLEngine, SSLCertificateFile,  SSLCertificateKeyFile and SSLCertificateChainFile lines, and restart Apache.

And now you can use the first subdomain which uses the self-signed certificate for sending the data from the ESP8266 to the server, while using the second for accessing the web interface from your browser. Certbot will also take care of automatically renewing you Let's Encrypt certificate every 3 months, using a systemd timer which should be enabled by default.

Step 6: Programming the ESP8266

/*
* Copyright (c) 2017 Manolis Agkopian
* See the file LICENSE for copying permission.
*/

#include <Arduino.h>
#include <ESP8266WiFi.h>
#include <ESP8266WiFiMulti.h>
#include <ESP8266HTTPClient.h>
#include <LiquidCrystal.h>
#include <SimpleDHT.h>

ESP8266WiFiMulti WiFiMulti;

const int rs = 4, en = 2, d4 = 13, d5 = 12, d6 = 14, d7 = 16;
LiquidCrystal lcd(rs, en, d4, d5, d6, d7);

int DHT11 = 5;
SimpleDHT11 dht;

void setup() {
  // Configure LCD
  lcd.begin(16, 4);

  // Configure WiFi
  WiFiMulti.addAP("[SSID]", "[Password]");
}

void loop() {
  byte temperature = 0;
  byte humidity = 0;
  char postData[100] = {0};

  // Sample rate is set to 1 Hz
  delay(1000);

  // Read the sensor
  if ( dht.read(DHT11, &temperature, &humidity, NULL) != SimpleDHTErrSuccess ) {
    lcd.setCursor(0, 1);
    lcd.print("Sensor Failure"); // In case of error output sensor failure and return
    return;
  }

  // Clear the sensor failure error message
  lcd.setCursor(0, 1);
  lcd.print("              ");

  // Output the temperature
  lcd.setCursor(0, 2);
  lcd.print("Temperature: ");
  lcd.print((int) temperature);
  lcd.print("C");

  // Output the humidity
  lcd.setCursor(0, 3);
  lcd.print("Humidity: ");
  lcd.print((int) humidity);
  lcd.print("%");

  sprintf(postData, "{\"client_id\":\"[Client ID]\",\"client_key\":\"[Client Key]\",\"temperature\":\"%d\",\"humidity\":\"%d\"}", (int) temperature, (int) humidity);
  
  // If connected to the WiFi send the mesurment to the server
  if((WiFiMulti.run() == WL_CONNECTED)) {
    
    HTTPClient http;

    // Set request URL
    http.begin("http://[Host]/log.php"); // For HTTPS connection the fingerprint of the certificate needs to be supplied as a second parameter

    // Start connection and send HTTP headers
    http.addHeader("Content-Type", "application/json");
    http.addHeader("Accept", "application/json");
    int httpCode = http.POST(postData);

    if( httpCode > 0 && httpCode == HTTP_CODE_OK ) {
      String payload = http.getString();
      lcd.setCursor(0, 0);
      lcd.print(payload);
    }
    else {
      String error = http.errorToString(httpCode).c_str();
    }
    http.end(); 
  }
}