We’re excited to announce that wolfCert now runs on the Zephyr RTOS!
wolfCert is wolfSSL’s open-source C library for client-side certificate lifecycle management. With the new Zephyr module, a Zephyr device can generate its own key, request a certificate from your PKI, and renew it later, all over a TLS connection secured by wolfSSL. To show the full flow on real hardware, we’re also releasing an EST enrollment example for NXP’s FRDM-MCXN947 board.
What is wolfCert?
wolfCert handles the device side of certificate provisioning, so your application doesn’t have to:
- Retrieve CA (trust chain) certificates from a PKI
- Enroll for a new device certificate, and re-enroll it before it expires
- Generate the private key on the device, in software or offloaded to secure hardware
- Build the CSR, submit it, and store the issued certificate
- Two enrollment protocols: EST (RFC 7030), for all key types, and SCEP (RFC 8894), for RSA keys
Key generation can be offloaded through wolfCrypt’s CryptoCb interface, the same mechanism that lets wolfSSL use HSMs, TPMs, PKCS#11 tokens, and secure elements. A device can therefore keep its private key in hardware while wolfCert runs the enrollment.
wolfCert on Zephyr
wolfCert now ships as a Zephyr module. Add it to your west manifest next to the wolfSSL module, then enable it with CONFIG_WOLFCERT=y:
- Kconfig integration: wolfCert options appear under wolfCert Support in menuconfig, with no separate settings header to maintain
- Uses Zephyr’s native networking stack for HTTP(S) transport
- Tested with Zephyr v4.4.2 and wolfSSL v5.9.4
- On-target unit test suites, run in CI under twister on qemu_x86
Example: EST Enrollment on NXP FRDM-MCXN947
The wolfcert_est_client sample enrolls one certificate over EST. The device generates an ECC P-256 key, sends a certificate request over TLS to an EST server, and prints the certificate it receives. The sample’s main() is short: set the clock, initialize, call wolfcert_client_enroll(), and print the result.
| Board | Network | Entropy |
|---|---|---|
| FRDM-MCXN947 | Ethernet (RJ45), DHCPv4 | On-chip TRNG |
| qemu_x86 | QEMU user networking | Test generator (emulation only) |
For testing, wolfCert includes a host-side EST server, wolfcert-server. Start it on a machine on the same network as the board:
$WOLFCERT/build/wolfcert-server --proto est --listen 0.0.0.0:8443 \
--basic alice:hunter2 --tls-cert --tls-key
Then build the sample with that server’s URL and flash it to the board:
west build -p -b frdm_mcxn947/mcxn947/cpu0 \
$WOLFCERT/zephyr/samples/wolfcert_est_client \
-- -DEXTRA_ZEPHYR_MODULES=$WOLFCERT \
"-DCONFIG_WOLFCERT_SAMPLE_EST_URL=\"https://192.0.2.10:8443/.well-known/est\""
west flash -r linkserver
A few seconds after reset, once DHCP assigns an address, the board prints its newly issued certificate on the console:
*** Booting Zephyr OS build*** enrolled: bytes -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----
Porting the sample to another board needs only a board .conf file. It sets the network interface, an entropy source, and stack and heap sizes. The full walkthrough, including server certificate setup and troubleshooting, is in the wolfCert Zephyr README.
Get Started
Zephyr support and the FRDM-MCXN947 example are available now on the main branch of wolfCert on GitHub.
Interested in automated certificate enrollment for your Zephyr devices? Contact us at facts@wolfSSL.com or +1 425 245 8247 for integration support.
Download wolfSSL Now