You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+35-37Lines changed: 35 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -104,7 +104,7 @@ Complete source code is available in [BasicWrite example](examples/BasicWrite/Ba
104
104
## Connecting to InfluxDB Cloud 2
105
105
Instead of setting up a local InfluxDB 2 server, it is possible to quickly [start with InfluxDB Cloud 2](https://docs.influxdata.com/influxdb/cloud/get-started/) with a [Free Plan](https://docs.influxdata.com/influxdb/cloud/account-management/pricing-plans/#free-plan).
106
106
107
-
InfluxDB Cloud uses secure communication over TLS (https). We need to tell the client to trust this connection. The paragraph bellow describes how to set trusted connection. However, InfluxDB cloud servers have only 3 months validity period. Their CA certificate, included in this library, has the validity period a year. This is not much for a long running device. To avoid such limitation you can use an untrusted connection. Check [Skipping certification validation](#skipping-certificate-validation) for more details.
107
+
InfluxDB Cloud uses secure communication over TLS (https). We need to tell the client to trust this connection. The paragraph bellow describes how to set trusted connection. However, InfluxDB cloud servers have only 3 months validity period. Their CA certificate, included in this library, is valid until 2035. Check [Skipping certification validation](#skipping-certificate-validation) for more details.
108
108
109
109
Connecting an Arduino client to InfluxDB Cloud server requires a few additional steps comparing to connecting to local server.
110
110
@@ -316,44 +316,40 @@ You can use a custom server certificate by exporting it, e.g. using a web browse
316
316
// Server certificate in PEM format, placed in the program (flash) memory to save RAM
@@ -390,9 +386,11 @@ Another important prerequisite to successfully validate a server or CA certifica
390
386
:information_source: Time synchronization is not required for validating server certificate via SHA1 fingerprint.
391
387
392
388
### Skipping certificate validation
393
-
Server certificates have limited validity period, often only a few months. It will be necessary to frequently change trusted certificate in the source code and reflashing the device. A solution could be using OTA update, but you will still need to care about certificate validity and updating it ahead of time to avoid connection failures.
389
+
The CA certificate provided with the library is ISRG Root X1. This certificate lasts a very long time, until 2035. It is not necessary to update your device until then when using ISRG Root X1.
394
390
395
-
Most comfortable way is to skip server certificate validation completely by establishing untrusted connection. This is done with the help of `InfluxDBClient::setInsecure()` method.
391
+
If you are using your own certificate, plase keep in mind server certificates have limited validity period, often only a few months. It will be necessary to frequently change trusted certificate in the source code and reflashing the device. A solution could be using OTA update, but you will still need to care about certificate validity and updating it ahead of time to avoid connection failures.
392
+
393
+
The best way to prevent frequent updates is to use a root certificate like the one provided with the library. If you are unable to use a root certificate from a trusted authority, you may want to use insecure mode instead. This is done with the help of `InfluxDBClient::setInsecure()` method.
396
394
You will also save space in flash (and RAM) by leaving certificate param empty when calling constructor or `setConnectionParams` method.
397
395
398
396
:memo: The `InfluxDBClient::setInsecure()` method must be called before calling any function that will establish connection. The best place to call it is in the `setup` method:
0 commit comments