There is an embedded device which acts a client. It communicates to a server via POST method whenever it has any data to be transmitted to the server.

Embedded device: 1. Acts a Client 2. Does not have any browser capability 3. Cannot be accessed by the user directly.
The data is availabe on the server if the user was to monitor.

We might be having a scenario as explained below:

  1. There is a main server which in turn has child servers.
  2. For each child server, the embedded devices will be connected
  3. The embedded devices connected to the child servers can be moved to other child server or main server by sending a command from the current server (change in the end points)
  4. So during the SSL handshake process, there will a certificate from the server coming to the device.

So the query is

Which & whose root CA certificate should be stored in the embedded device (main or child servers)



1 Answer 1


For the scenario you described you should have the root certificate of the main server sign the child server certificates. The embedded devices would then store the main server's root certificate.

In this way any child server could connect to an embedded device, and the embedded device would trust it because the certificate chain is trusted.

I would then create an SSL certificate for the main server signed by it's root certificate. This certificate would be used for when embedded devices are connected to the main server rather than a child server.

  • Thanks for your reply. But can we to have a certificates chain on the embedded devcie because of the resource constraints on the controller/processeor. especially the memory (flash or data eeprom).
    – ssk
    Oct 5, 2014 at 7:21
  • The embedded device will have to verify a certificate. I don't think a cert chain is going to add any more stress on the processor that SSL doesn't already add. And you will still only store one root certificate.
    – RoraΖ
    Oct 5, 2014 at 12:29
  • I got from one of the site realtimelogic.com/blog/2013/10 that using chain certitificates on microcontollers should be avoided.
    – ssk
    Oct 5, 2014 at 18:08
  • @ssk if you want to post the constraints of your particular device I'd be happy to amend my answer. However, the link you posted is generic to devices, and a single certificate shouldn't effect performance. Some certificate chains can be as long as 3 or 4, which I believe that article is referring. If you want to post links to the specific device you're working with I'd be happy to amend my answer.
    – RoraΖ
    Oct 6, 2014 at 11:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .