Drop x25519, use p256 only

tutorials/http/jwt-auth/main.c

@@ -21,9 +21,9 @@ static size_t verify_es256(struct mg_str token, char *claims, size_t len) {
   struct mg_jwt_opts opts = {.public_key = pub};
   // This keeps the example self-contained. A real verifier would usually keep
   // only the issuer public key, selected by kid, not the signing private key.
-  if (mg_uecc_parse_private_key(mg_str(s_ec_private_key), key, sizeof(key)) !=
+  if (mg_p256_parse_private_key(mg_str(s_ec_private_key), key, sizeof(key)) !=
           32 ||
-      mg_uecc_compute_public_key(key, pub, mg_uecc_secp256r1()) != 1) {
+      mg_p256_compute_public_key(key, pub) != 1) {
     return 0;
   }
   return mg_jwt_verify_es256(token, &opts, claims, len);
@@ -65,10 +65,9 @@ static void fn(struct mg_connection *c, int ev, void *ev_data) {
                                  .private_key = key};
       size_t keysz, n;
       keysz =
-          mg_uecc_parse_private_key(mg_str(s_ec_private_key), key, sizeof(key));
+          mg_p256_parse_private_key(mg_str(s_ec_private_key), key, sizeof(key));
       // ES256 uses a raw 64-byte r || s signature. mg_jwt_sign_es256() signs it
-      // deterministically; applications can also hash the signing input and
-      // call mg_uecc_sign() directly if they need random-nonce ECDSA.
+      // deterministically (RFC 6979), see mg_p256_sign()
       mg_snprintf(claims, CLAIMS_LEN, "{%m:%m,%m:%m}", MG_ESC("sub"),
                   MG_ESC("admin"), MG_ESC("scope"), MG_ESC("dash:read"));
       opts.claims = mg_str(claims);

tutorials/nxp/frdm-imxrt1186/minimal/main.c

@@ -37,8 +37,35 @@ bool mg_random(void *buf, size_t len) {
 }
 #endif
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -70,6 +97,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/nxp/frdm-imxrt1186/minimal/mongoose_config.h

@@ -1,4 +1,5 @@
 #define MG_ARCH MG_ARCH_ARMGCC
+#define MG_TLS MG_TLS_BUILTIN
 #define MG_ENABLE_TCPIP 1
 #define MG_ENABLE_DRIVER_NETC 1
 #define MG_OTA MG_OTA_RT1180

tutorials/nxp/frdm-mcxe247/minimal/main.c

@@ -61,8 +61,35 @@ bool mg_random(void *buf, size_t len) {
 }
 #endif
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -97,6 +124,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/nxp/frdm-mcxe247/minimal/mongoose_config.h

@@ -2,6 +2,7 @@
 
 // See https://mongoose.ws/documentation/#build-options
 #define MG_ARCH MG_ARCH_ARMGCC
+#define MG_TLS MG_TLS_BUILTIN
 
 #define MG_ENABLE_TCPIP 1
 #define MG_ENABLE_DRIVER_MCXE 1

tutorials/nxp/frdm-mcxn947/minimal/main.c

@@ -69,8 +69,35 @@ bool mg_random(void *buf, size_t len) {
 }
 #endif
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -105,6 +132,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/nxp/frdm-mcxn947/minimal/mongoose_config.h

@@ -2,6 +2,7 @@
 
 // See https://mongoose.ws/documentation/#build-options
 #define MG_ARCH MG_ARCH_ARMGCC
+#define MG_TLS MG_TLS_BUILTIN
 #define MG_OTA MG_OTA_MCXN
 
 #define MG_ENABLE_TCPIP 1

tutorials/nxp/frdm-rw612/minimal/main.c

@@ -37,8 +37,35 @@ bool mg_random(void *buf, size_t len) {
 }
 #endif
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -73,6 +100,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/nxp/rt1060-evkb/minimal/main.c

@@ -33,8 +33,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -64,6 +91,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/nxp/rt1060-evkb/minimal/mongoose_config.h

@@ -2,6 +2,7 @@
 
 // See https://mongoose.ws/documentation/#build-options
 #define MG_ARCH MG_ARCH_ARMGCC
+#define MG_TLS MG_TLS_BUILTIN
 #define MG_OTA MG_OTA_RT1060
 
 #define MG_ENABLE_TCPIP 1

tutorials/nxp/rt1170-evkb/minimal/main.c

@@ -37,8 +37,35 @@ bool mg_random(void *buf, size_t len) {
 }
 #endif
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -70,6 +97,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/nxp/rt1170-evkb/minimal/mongoose_config.h

@@ -2,6 +2,7 @@
 
 // See https://mongoose.ws/documentation/#build-options
 #define MG_ARCH MG_ARCH_ARMGCC
+#define MG_TLS MG_TLS_BUILTIN
 
 #define MG_ENABLE_TCPIP 1
 #define MG_ENABLE_DRIVER_IMXRT11 1

tutorials/rp/pico-rm2/CMakeLists.txt

@@ -7,8 +7,8 @@ include(pico_sdk_import.cmake)
 project(firmware)
 pico_sdk_init()
 
-add_executable(firmware main.c wifi.c mongoose/mongoose.c)
-target_include_directories(firmware PRIVATE mongoose)
+add_executable(firmware main.c wifi.c ../../../mongoose.c)
+target_include_directories(firmware PRIVATE ../../.. ./)
 
 target_link_libraries(firmware hardware_pio pico_stdlib pico_rand  hardware_flash pico_bootrom)
 pico_add_extra_outputs(firmware)     # create map/bin/hex file etc.

tutorials/rp/pico-rm2/Makefile

@@ -14,13 +14,11 @@ endif
 
 all build example: build/firmware.uf2
 
-build/firmware.uf2: pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h
+build/firmware.uf2: pico_sdk_import.cmake
 
 pico_sdk_import.cmake: $(SDK_PATH)
 	cp $(SDK_PATH)/external/$@ $@
 
-mongoose/mongoose.c mongoose/mongoose.h:
-	cp ../../../$(notdir $@) $@
 
 build/firmware.uf2: $(SDK_PATH) $(wildcard *.[ch]) CMakeLists.txt Makefile
 	$(MKBUILD)
@@ -30,7 +28,7 @@ flash: build/firmware.uf2
 	picotool load $< -f
 
 clean:
-	$(RM) build pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h $(SDK_PATH)
+	$(RM) build pico_sdk_import.cmake $(SDK_PATH)
 
 $(SDK_PATH):
 	git clone -c advice.detachedHead=false --quiet --depth 1 -b 2.1.1 https://github.com/raspberrypi/pico-sdk $@

tutorials/rp/pico-rmii/CMakeLists.txt

@@ -7,8 +7,8 @@ include(pico_sdk_import.cmake)
 project(firmware)
 pico_sdk_init()
 
-add_executable(firmware main.c driver_rp2040_rmii.c mongoose/mongoose.c)
-target_include_directories(firmware PRIVATE . mongoose)
+add_executable(firmware main.c driver_rp2040_rmii.c ../../../mongoose.c)
+target_include_directories(firmware PRIVATE ../../.. ./)
 
 target_link_libraries(firmware hardware_pio hardware_dma pico_stdlib pico_rand)
 pico_add_extra_outputs(firmware)     # create map/bin/hex file etc.

tutorials/rp/pico-rmii/Makefile

@@ -14,13 +14,11 @@ endif
 
 all build example: build/firmware.uf2
 
-build/firmware.uf2: pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h
+build/firmware.uf2: pico_sdk_import.cmake
 
 pico_sdk_import.cmake: $(SDK_PATH)
 	cp $(SDK_PATH)/external/$@ $@
 
-mongoose/mongoose.c mongoose/mongoose.h:
-	cp ../../../$(notdir $@) $@
 
 build/firmware.uf2: $(SDK_PATH) $(wildcard *.[ch]) CMakeLists.txt Makefile
 	$(MKBUILD)
@@ -30,7 +28,7 @@ flash: build/firmware.uf2
 	picotool load $< -f
 
 clean:
-	$(RM) build pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h $(SDK_PATH)
+	$(RM) build pico_sdk_import.cmake $(SDK_PATH)
 
 $(SDK_PATH):
 	git clone -c advice.detachedHead=false --quiet --depth 1 -b 2.1.1 https://github.com/raspberrypi/pico-sdk $@

tutorials/rp/pico-rndis-device/CMakeLists.txt

@@ -7,12 +7,13 @@ pico_sdk_init()
 add_executable(firmware
   main.c
   usb_descriptors.c
-  mongoose.c
+  ../../../mongoose.c
   net.c
   pico-sdk/lib/tinyusb/lib/networking/rndis_reports.c)
 
 target_include_directories(firmware PUBLIC
-  .
+  ../../..
+  ./
   pico-sdk/lib/tinyusb/lib/networking)
 
 target_link_libraries(firmware pico_stdlib pico_rand hardware_spi tinyusb_device)

tutorials/rp/pico-rndis-device/mongoose.c

@@ -1 +0,0 @@
-../../../mongoose.c

tutorials/rp/pico-rndis-device/mongoose.h

@@ -1 +0,0 @@
-../../../mongoose.h

tutorials/rp/pico-rndis/CMakeLists.txt

@@ -11,12 +11,12 @@ add_executable(firmware
   main.c
   msc_disk.c
   usb_descriptors.c
-  mongoose/mongoose.c
+  ../../../mongoose.c
   pico-sdk/lib/tinyusb/lib/networking/rndis_reports.c)
 
 target_include_directories(firmware PRIVATE
-  .
-  mongoose
+  ../../..
+  ./
   pico-sdk/lib/tinyusb/lib/networking)
 
 target_link_libraries(firmware pico_stdlib pico_rand hardware_spi tinyusb_device)

tutorials/rp/pico-rndis/Makefile

@@ -14,13 +14,11 @@ endif
 
 all build example: build/firmware.uf2
 
-build/firmware.uf2: pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h
+build/firmware.uf2: pico_sdk_import.cmake
 
 pico_sdk_import.cmake: $(SDK_PATH)
 	cp $(SDK_PATH)/external/$@ $@
 
-mongoose/mongoose.c mongoose/mongoose.h:
-	cp ../../../$(notdir $@) $@
 
 build/firmware.uf2: $(SDK_PATH) $(wildcard *.[ch]) CMakeLists.txt Makefile
 	$(MKBUILD)
@@ -30,7 +28,7 @@ flash: build/firmware.uf2
 	picotool load $< -f
 
 clean:
-	$(RM) build pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h $(SDK_PATH)
+	$(RM) build pico_sdk_import.cmake $(SDK_PATH)
 
 $(SDK_PATH):
 	git clone -c advice.detachedHead=false --quiet --depth 1 -b 2.1.1 https://github.com/raspberrypi/pico-sdk $@

tutorials/rp/pico-w/CMakeLists.txt

@@ -1,14 +1,14 @@
 cmake_minimum_required(VERSION 3.13)
 
 # If you will set board type here, do it BEFORE including the SDK
-set(PICO_BOARD pico_w)
+set(PICO_BOARD pico2_w)
 include(pico_sdk_import.cmake)
 
 project(firmware)
 pico_sdk_init()
 
-add_executable(firmware main.c wifi.c mongoose/mongoose.c)
-target_include_directories(firmware PRIVATE mongoose)
+add_executable(firmware main.c wifi.c ../../../mongoose.c)
+target_include_directories(firmware PRIVATE ../../.. ./)
 
 target_link_libraries(firmware pico_stdlib hardware_spi pico_rand pico_cyw43_driver pico_cyw43_arch_none hardware_flash pico_bootrom)
 pico_add_extra_outputs(firmware)     # create map/bin/hex file etc.

tutorials/rp/pico-w/Makefile

@@ -14,13 +14,11 @@ endif
 
 all build example: build/firmware.uf2
 
-build/firmware.uf2: pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h
+build/firmware.uf2: pico_sdk_import.cmake
 
 pico_sdk_import.cmake: $(SDK_PATH)
 	cp $(SDK_PATH)/external/$@ $@
 
-mongoose/mongoose.c mongoose/mongoose.h:
-	cp ../../../$(notdir $@) $@
 
 build/firmware.uf2: $(SDK_PATH) $(wildcard *.[ch]) CMakeLists.txt Makefile
 	$(MKBUILD)
@@ -30,7 +28,7 @@ flash: build/firmware.uf2
 	picotool load $< -f
 
 clean:
-	$(RM) build pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h $(SDK_PATH)
+	$(RM) build pico_sdk_import.cmake $(SDK_PATH)
 
 $(SDK_PATH):
 	git clone -c advice.detachedHead=false --quiet --depth 1 -b 2.1.1 https://github.com/raspberrypi/pico-sdk $@

tutorials/rp/pico-w/main.c

@@ -11,8 +11,35 @@ static void blink_task(void) {
   }
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     uint64_t tick = to_ms_since_boot(get_absolute_time());
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
@@ -34,6 +61,7 @@ static void run_mongoose(void) {
   mg_log_set_fn(log_fn, NULL);
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   for (;;) {
     mg_mgr_poll(&mgr, 1);

tutorials/rp/pico-w/mongoose_config.h

@@ -2,6 +2,7 @@
 
 // Build options: https://mongoose.ws/docs/getting-started/build-options/
 #define MG_ARCH MG_ARCH_PICOSDK
+#define MG_TLS MG_TLS_BUILTIN
 #define MG_OTA MG_OTA_PICOSDK
 #define MG_IO_SIZE 2048
 

tutorials/rp/w5500-evb-pico/CMakeLists.txt

@@ -7,8 +7,8 @@ include(pico_sdk_import.cmake)
 project(firmware)
 pico_sdk_init()
 
-add_executable(firmware main.c mongoose/mongoose.c)
-target_include_directories(firmware PRIVATE mongoose)
+add_executable(firmware main.c ../../../mongoose.c)
+target_include_directories(firmware PRIVATE ../../.. ./)
 
 target_link_libraries(firmware pico_stdlib hardware_spi pico_rand hardware_flash pico_bootrom)
 pico_add_extra_outputs(firmware)     # create map/bin/hex file etc.

tutorials/rp/w5500-evb-pico/Makefile

@@ -14,13 +14,11 @@ endif
 
 all build example: build/firmware.uf2
 
-build/firmware.uf2: pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h
+build/firmware.uf2: pico_sdk_import.cmake
 
 pico_sdk_import.cmake: $(SDK_PATH)
 	cp $(SDK_PATH)/external/$@ $@
 
-mongoose/mongoose.c mongoose/mongoose.h:
-	cp ../../../$(notdir $@) $@
 
 build/firmware.uf2: $(SDK_PATH) $(wildcard *.[ch]) CMakeLists.txt Makefile
 	$(MKBUILD)
@@ -30,7 +28,7 @@ flash: build/firmware.uf2
 	picotool load $< -f
 
 clean:
-	$(RM) build pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h $(SDK_PATH)
+	$(RM) build pico_sdk_import.cmake $(SDK_PATH)
 
 $(SDK_PATH):
 	git clone -c advice.detachedHead=false --quiet --depth 1 -b 2.1.1 https://github.com/raspberrypi/pico-sdk $@

tutorials/rp/w5500-evb-pico/main.c

@@ -54,8 +54,35 @@ static void blink_task(void) {
   }
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     uint64_t tick = to_ms_since_boot(get_absolute_time());
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
@@ -86,6 +113,7 @@ static void run_mongoose(void) {
   MG_INFO(("Driver: W5500, MAC: %M", mg_print_mac, mif.mac));
 
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   for (;;) {
     mg_mgr_poll(&mgr, 1);

tutorials/rp/w5500-evb-pico/mongoose_config.h

@@ -2,6 +2,7 @@
 
 // Build options: https://mongoose.ws/docs/getting-started/build-options/
 #define MG_ARCH MG_ARCH_PICOSDK
+#define MG_TLS MG_TLS_BUILTIN
 #define MG_OTA MG_OTA_PICOSDK
 #define MG_IO_SIZE 2048
 

tutorials/rp/w55rp20-evb-pico/CMakeLists.txt

@@ -6,8 +6,8 @@ include(pico_sdk_import.cmake)
 project(firmware)
 pico_sdk_init()
 
-add_executable(firmware main.c mongoose/mongoose.c)
-target_include_directories(firmware PRIVATE mongoose)
+add_executable(firmware main.c ../../../mongoose.c)
+target_include_directories(firmware PRIVATE ../../.. ./)
 
 target_link_libraries(firmware pico_stdlib hardware_pio pico_rand hardware_flash pico_bootrom)
 pico_add_extra_outputs(firmware)     # create map/bin/hex file etc.

tutorials/rp/w55rp20-evb-pico/Makefile

@@ -14,13 +14,11 @@ endif
 
 all build example: build/firmware.uf2
 
-build/firmware.uf2: pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h
+build/firmware.uf2: pico_sdk_import.cmake
 
 pico_sdk_import.cmake: $(SDK_PATH)
 	cp $(SDK_PATH)/external/$@ $@
 
-mongoose/mongoose.c mongoose/mongoose.h:
-	cp ../../../$(notdir $@) $@
 
 build/firmware.uf2: $(SDK_PATH) $(wildcard *.[ch]) CMakeLists.txt Makefile
 	$(MKBUILD)
@@ -30,7 +28,7 @@ flash: build/firmware.uf2
 	picotool load $< -f
 
 clean:
-	$(RM) build pico_sdk_import.cmake mongoose/mongoose.c mongoose/mongoose.h $(SDK_PATH)
+	$(RM) build pico_sdk_import.cmake $(SDK_PATH)
 
 $(SDK_PATH):
 	git clone -c advice.detachedHead=false --quiet --depth 1 -b 2.1.1 https://github.com/raspberrypi/pico-sdk $@

tutorials/rp/w55rp20-evb-pico/main.c

@@ -167,8 +167,35 @@ static void blink_task(void) {
   }
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     uint64_t tick = to_ms_since_boot(get_absolute_time());
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
@@ -191,6 +218,7 @@ static void run_mongoose(void) {
   mg_log_set_fn(log_fn, NULL);
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   for (;;) {
     mg_mgr_poll(&mgr, 1);

tutorials/stm32/nucleo-f429zi/minimal/main.c

@@ -40,8 +40,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -73,6 +100,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/stm32/nucleo-f746zg/minimal/main.c

@@ -40,8 +40,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -73,6 +100,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/stm32/nucleo-f756zg/minimal/main.c

@@ -40,8 +40,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -73,6 +100,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/stm32/nucleo-h563zi/minimal/link.ld

@@ -4,7 +4,7 @@ MEMORY {
   sram(rwx) : ORIGIN = 0x20000000, LENGTH = 640k
 }
 _estack = ORIGIN(sram) + LENGTH(sram);    /* End of RAM. stack points here */
-_sstack = _estack - 4098;
+_sstack = _estack - 16384;                /* Stack limit, MSPLIM. TLS needs > 4 KB */
 
 SECTIONS {
   .vectors  : { KEEP(*(.isr_vector)) }  > flash

tutorials/stm32/nucleo-h563zi/minimal/main.c

@@ -40,8 +40,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -80,6 +107,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/stm32/nucleo-h563zi/minimal/mongoose_config.h

@@ -38,3 +38,5 @@
     mac[4] = MGUID[1] & 255;         \
     mac[5] = MGUID[2] & 255;         \
   } while (0)
+
+#define MG_ENABLE_HEALTH 1

tutorials/stm32/nucleo-h723zg/minimal-bsd-baremetal/Makefile

@@ -1,23 +1,21 @@
 # Copyright (c) 2026 Cesanta Software Limited
 # Environment setup: https://mongoose.ws/docs/getting-started/build-environment/
 
+MGDIR = ../../../..
 CFLAGS  = -W -Wall -Wextra -Wundef -Wshadow -Wdouble-promotion
 CFLAGS += -Wformat-truncation -fno-common -Wconversion -Wno-sign-conversion
 CFLAGS += -g3 -Os -ffunction-sections -fdata-sections
-CFLAGS += -I. -Icmsis_core/CMSIS/Core/Include -Icmsis_h7/Include -Imongoose
+CFLAGS += -I. -I$(MGDIR) -Icmsis_core/CMSIS/Core/Include -Icmsis_h7/Include
 CFLAGS += -mcpu=cortex-m7 -mthumb -mfloat-abi=hard -mfpu=fpv5-d16 $(CFLAGS_EXTRA)
 LDFLAGS ?= -Tlink.ld -nostdlib -nostartfiles --specs nosys.specs -lc -lgcc -Wl,--gc-sections -Wl,-Map=$@.map
 
 SOURCES = main.c hal.c echo.c
 SOURCES += cmsis_h7/Source/Templates/gcc/startup_stm32h723xx.s
-SOURCES += mongoose/mongoose.c
+SOURCES += $(MGDIR)/mongoose.c
 
 all build example: firmware.bin
 
-mongoose/mongoose.c mongoose/mongoose.h:
-	cp ../../../../mongoose.[ch] mongoose/
-
-firmware.elf: cmsis_core cmsis_h7 hal.h link.ld Makefile $(SOURCES) mongoose/mongoose.h
+firmware.elf: cmsis_core cmsis_h7 hal.h link.ld Makefile $(SOURCES) $(MGDIR)/mongoose.h mongoose_config.h
 	arm-none-eabi-gcc $(SOURCES) $(CFLAGS) $(CFLAGS_EXTRA) $(LDFLAGS) -o $@
 
 firmware.bin: firmware.elf
@@ -35,4 +33,4 @@ cmsis_h7:
 	git clone -q -c advice.detachedHead=false --depth 1 -b v1.10.6 https://github.com/STMicroelectronics/cmsis_device_h7 $@
 
 clean:
-	rm -rf firmware.* cmsis_* mongoose/mongoose.*
+	rm -rf firmware.* cmsis_*

tutorials/stm32/nucleo-h723zg/minimal-bsd-baremetal/echo.c

@@ -114,3 +114,21 @@ void echo_poll(void) {
     p = &c->next;
   }
 }
+
+// On desktop, build with -DMAIN flag to include main().
+// On embedded system, run this code in your main() function
+#ifdef MAIN
+int main(void) {
+  struct mg_mgr mgr;
+
+  mg_mgr_init(&mgr);
+  echo_init(1234);
+
+  for (;;) {
+    mg_mgr_poll(&mgr, 1);
+    echo_poll();
+  }
+
+  return 0;
+}
+#endif

tutorials/stm32/nucleo-h723zg/minimal-bsd-baremetal/mongoose/mongoose.c

@@ -1 +0,0 @@
-../../../../mongoose.c

tutorials/stm32/nucleo-h723zg/minimal-bsd-baremetal/mongoose/mongoose.h

@@ -1 +0,0 @@
-../../../../mongoose.h

tutorials/stm32/nucleo-h723zg/minimal-bsd-freertos/Makefile

@@ -1,16 +1,17 @@
 # Copyright (c) 2026 Cesanta Software Limited
 # Environment setup: https://mongoose.ws/docs/getting-started/build-environment/
 
+MGDIR = ../../../..
 CFLAGS  = -W -Wall -Wextra -Wundef -Wshadow -Wdouble-promotion
 CFLAGS += -Wformat-truncation -fno-common -Wconversion -Wno-sign-conversion
 CFLAGS += -g3 -Os -ffunction-sections -fdata-sections
-CFLAGS += -I. -Icmsis_core/CMSIS/Core/Include -Icmsis_h7/Include -Imongoose
+CFLAGS += -I. -I$(MGDIR) -Icmsis_core/CMSIS/Core/Include -Icmsis_h7/Include
 CFLAGS += -mcpu=cortex-m7 -mthumb -mfloat-abi=hard -mfpu=fpv5-d16 $(CFLAGS_EXTRA)
 LDFLAGS ?= -Tlink.ld -nostdlib -nostartfiles --specs nano.specs -lc -lgcc -Wl,--gc-sections
 
 SOURCES = main.c hal.c
 SOURCES += cmsis_h7/Source/Templates/gcc/startup_stm32h723xx.s
-SOURCES += mongoose/mongoose.c
+SOURCES += $(MGDIR)/mongoose.c
 
 # FreeRTOS. H7 has a Cortex-M7 r1p0 core, FreeRTOS recommends using CM4F port for non-r0p1 CM7 micros
 SOURCES += FreeRTOS-Kernel/tasks.c FreeRTOS-Kernel/list.c FreeRTOS-Kernel/queue.c
@@ -21,10 +22,7 @@ CFLAGS += -IFreeRTOS-Kernel/portable/GCC/ARM_CM4F -Wno-conversion
 
 all build example: firmware.bin
 
-mongoose/mongoose.c mongoose/mongoose.h:
-	cp ../../../../mongoose.[ch] mongoose/
-
-firmware.elf: cmsis_core cmsis_h7 FreeRTOS-Kernel hal.h link.ld Makefile $(SOURCES) mongoose/mongoose.h
+firmware.elf: cmsis_core cmsis_h7 FreeRTOS-Kernel hal.h link.ld Makefile $(SOURCES) $(MGDIR)/mongoose.h mongoose_config.h
 	arm-none-eabi-gcc $(SOURCES) $(CFLAGS) $(CFLAGS_EXTRA) $(LDFLAGS) -o $@
 
 firmware.bin: firmware.elf
@@ -49,7 +47,7 @@ FreeRTOS-Kernel:
 	git clone --depth 1 -b V11.3.0 https://github.com/FreeRTOS/FreeRTOS-Kernel $@
 
 clean:
-	rm -rf firmware.* cmsis_* mongoose/mongoose.* FreeRTOS-Kernel
+	rm -rf firmware.* cmsis_* FreeRTOS-Kernel
 
 
 # Automated remote test. Requires env variable VCON_API_KEY set. See https://vcon.io/automated-firmware-tests/

tutorials/stm32/nucleo-h723zg/minimal/main.c

@@ -40,8 +40,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -73,6 +100,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/stm32/nucleo-h743zi/minimal/main.c

@@ -40,8 +40,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -73,6 +100,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/stm32/nucleo-n657x0-q/minimal/link.ld

@@ -4,7 +4,7 @@ MEMORY {
   sram  (rwx) : ORIGIN = 0x34000000, LENGTH = 2048K
 }
 _estack = ORIGIN(sram) + LENGTH(sram);
-_sstack = _estack - 4096;
+_sstack = _estack - 16384;  /* Stack limit, MSPLIM. TLS needs > 4 KB */
 
 SECTIONS {
   .vectors  : { KEEP(*(.isr_vector)) }  > flash

tutorials/stm32/nucleo-n657x0-q/minimal/main.c

@@ -36,8 +36,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -73,6 +100,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/stm32/nucleo-u5a5zj-q/minimal/main.c

@@ -32,8 +32,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -66,6 +93,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/stm32/portenta-h7/minimal/main.c

@@ -40,8 +40,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -74,6 +101,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/stm32/stm32h573i-dk/minimal/main.c

@@ -40,8 +40,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -73,6 +100,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));

tutorials/stm32/stm32h747i-disco/minimal/main.c

@@ -40,8 +40,35 @@ bool mg_random(void *buf, size_t len) {
   return true;
 }
 
+// Self-signed P-256 certificate and key for the HTTPS listener. Created by:
+//   openssl ecparam -genkey -name prime256v1 -noout -out key.pem
+//   openssl req -x509 -key key.pem -out cert.pem -days 3650 -subj /CN=mg
+#define TLS_CERT                                                       \
+  "-----BEGIN CERTIFICATE-----\n"                                      \
+  "MIIBgjCCASegAwIBAgIUIJOq77Qn7lHbH6WseMemeqorR50wCgYIKoZIzj0EAwIw\n" \
+  "FjEUMBIGA1UEAwwLbnVjbGVvLWg3MjMwHhcNMjYxMDEyMTUwMjE5WhcNMzYxMDA5\n" \
+  "MTUwMjE5WjAWMRQwEgYDVQQDDAtudWNsZW8taDcyMzBZMBMGByqGSM49AgEGCCqG\n" \
+  "SM49AwEHA0IABB6IQJNmzrsdQL+2BnZYS7GYOaj7sz8f6cjBmz3n8D9Em19XodlU\n" \
+  "uy4ybIvyhr766lL0ERoTmMUivb/lGmzx9C+jUzBRMB0GA1UdDgQWBBQqxMuc4gj7\n" \
+  "MTMzreWlRMNI3QMqTzAfBgNVHSMEGDAWgBQqxMuc4gj7MTMzreWlRMNI3QMqTzAP\n" \
+  "BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0kAMEYCIQDY4xaJpuxq6b3rHK3b\n" \
+  "lOIQyfkQX+orCRqQUkseplqpqwIhAKswZFNn+2zUNRRNY8+cHmdIwmdpsmxtoWYP\n" \
+  "BCjX++LI\n"                                                         \
+  "-----END CERTIFICATE-----\n"
+
+#define TLS_KEY                                                        \
+  "-----BEGIN EC PRIVATE KEY-----\n"                                   \
+  "MHcCAQEEIJ/GBl0TlD52q9PMg1KWaNIdXqp8b/HyIsABmBpqC+O1oAoGCCqGSM49\n" \
+  "AwEHoUQDQgAEHohAk2bOux1Av7YGdlhLsZg5qPuzPx/pyMGbPefwP0SbX1eh2VS7\n" \
+  "LjJsi/KGvvrqUvQRGhOYxSK9v+UabPH0Lw==\n"                             \
+  "-----END EC PRIVATE KEY-----\n"
+
 static void http_ev_handler(struct mg_connection *c, int ev, void *ev_data) {
-  if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
+  if (ev == MG_EV_ACCEPT && c->is_tls) {  // Accepted on the https:// listener
+    struct mg_tls_opts opts = {.cert = mg_str(TLS_CERT),
+                               .key = mg_str(TLS_KEY)};
+    mg_tls_init(c, &opts);
+  } else if (ev == MG_EV_HTTP_MSG) {  // New HTTP request received
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     if (mg_match(hm->uri, mg_str("/api/tick"), NULL)) {
       mg_http_reply(c, 200, "", "{%m:%llu}\n", MG_ESC("tick"), hal_get_tick());
@@ -73,6 +100,7 @@ int main(void) {
   struct mg_mgr mgr;
   mg_mgr_init(&mgr);
   mg_http_listen(&mgr, "http://0.0.0.0", http_ev_handler, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0", http_ev_handler, NULL);
 
   MG_INFO(("Initialised. CPU clock: %lu MHz", SystemCoreClock / 1000000));
   MG_INFO(("RAM used: %zu, free: %zu", hal_ram_used(), hal_ram_free()));