ESP32 Forum

Hello everyone,

I am in the middle of preparing a deployment of our modest IOT fleet based on the ESP32. Amongst all the moving targets is one in particular I have questions about: Preparing 250 units.

The problem I have is this; our fleet is not large enough to warrant developing an auto provisioning system to get X.509 certs on every device via onboarding/enrollment. Maybe if the fleet got bigger we would do it, but at 250 it seems like a wasted investment. So it's manual work. We're going to run everything "unhardened" for a while, before we pull the trigger to harden them, so there is room for mistakes. Every device is slightly different in a few ways though:
* every device has a passive NFC tag attached to it with a unique 7-byte UID. That UID needs to be flashed as an NVS key.
* every device has its own X.509 device cert from AWS IOT that needs to be flashed as an NVS key.
* every device has its own X.509 private key from AWS IOT that needs to be flashed as an NVS key.

For the rest, the factory app, first OTA app, SSID/PASS NVS keys, etc. is the same for every device.

Now I've been reading up on the manufacturing guide, and experimenting with the ESP32 Flash Download Tool, and it seemed like I was on my way there. But it turns out the ESP32 Flash Download Tool is missing one obvious function; to make some of its partitions fixed, and some of its partitions dependent on the Downloader/COM.

I did come across a directory called flashtool/dl_temp/bin_temp/downloadPanel#/ of which there were 8, and each had the binary to be flashed in them. So it seems the entire tool was setup to support some sort of variance between instances of Downloaders. I just can't seem to find the setting for it.

Has anyone faced any similar issues? Help would be appreciated; I need to start flashing in August already.

Is using esptool.py an option?
Notice that you can/must provide the name of each binary file for each partition on the command line, so it should be pretty easy to script esptool.py to run multiple times and on each iteration have it flash the same application but use a different binary file for a specific nvs partition.

Yeah, I was thinking of that as a fallback option. I'd need the full esp idf environment on every flashing machine though, which is why I thought the ESP32 Flash Download Tool was such a good option. But there may be no way around it.

Thanks for the suggestion.

What you can do is to merge the partitions you want before flashing (some individual, some common, depends on how you write the script) to one bin and flash that one on production line instead - merge_bin option of esptool.py should do the trick. That should work and I'm actually doing very simillar thing, because installing and setting up build environment on production machines just to flash it did not seem right to me.

It even seems to be working with fully locked code and security options enabled, you just have to check the first startup after flashing to see that all the flash encryptions did happen successfully, but that is just another production step.

Edit: Also don't forget to change the start address in flash tool to 0x0