Wiring an ESP32 to AWS IoT Core with X.509 certificates
From flashing firmware to the first MQTT message, step by step.
Short answer
To connect an ESP32 to AWS IoT Core, create a Thing, download its X.509 certificate and private key, attach an IoT policy that allows iot:Connect and iot:Publish, then use WiFiClientSecure with the Amazon Root CA, device certificate and key to open an MQTT connection on port 8883 to your account endpoint.
Key takeaways
- Every device gets its own X.509 certificate; never share keys between devices.
- Scope the IoT policy to the client ID and topics the device actually needs.
- Most connection failures are a wrong endpoint, a missing policy, or clock skew.
Placeholder article body. This will be replaced by content from WordPress.
What we are building
An ESP32 publishes sensor readings to AWS IoT Core over MQTT using mutual TLS.
Create the Thing and certificate
In the AWS IoT console, create a Thing, generate a certificate, and download the certificate, private key and Amazon Root CA.
Flash the firmware
client.setCACert(AWS_ROOT_CA);
client.setCertificate(DEVICE_CERT);
client.setPrivateKey(DEVICE_KEY);Troubleshooting
If the connection drops immediately, check the policy first.
Frequently asked questions
Which port does AWS IoT Core MQTT use?
MQTT over TLS uses port 8883. MQTT over WebSockets and ALPN-based connections can use port 443.
Can several ESP32 devices share one certificate?
They can, but they should not: a shared certificate cannot be revoked per device and makes client IDs collide.
One build log a month.
New posts on Salesforce, AWS IoT, ESP32 and running a tiny factory. No spam.