Documentation › TLS / HTTPS

TLS / HTTPS guide

HTTPS is terminated in the dongle: the Pico W performs the TLS 1.2 handshake with mbedTLS, then streams the decrypted response over the serial link. The host computer never sees encrypted traffic — this is what lets an 8-bit machine reach HTTPS services.

Fetch a page over TLS

ATGEThttps://example.com

The ATPOST command additionally enables HTTP/HTTPS POST requests.

Certificate verification

By default, verification is off (AT$CV0, insecure: any server certificate is accepted). To verify the server certificate against a trusted root:

AT$CA=                 then paste a CA in PEM form,
-----BEGIN CERTIFICATE-----
…                      finish with a line containing only a single "."
-----END CERTIFICATE-----
.
AT$CV1                 enable verification (ERROR if no CA is stored)
AT&W                   persist

With a CA loaded and AT$CV1 enabled, a connection whose certificate does not chain to that CA (expired, self-signed, unknown root, wrong hostname) is refused. AT$CA? reports the stored CA size; AT$CA- deletes it.

Never fails open: AT$CV1 returns ERROR while no CA is present — you cannot enable verification without a trust anchor.

There is no on-board clock: certificate expiry dates are not checked; trust is established via the CA chain and hostname (SNI).

Where the encryption lives

   Oric 8-bit            LOCI               Pico W modem              Internet
 ┌────────────┐  bus   ┌────────┐ USB CDC ┌────────────────┐  WiFi  ┌──────────┐
 │  host /    │◀──────▶│  LOCI  │◀───────▶│ PicoWiFiModemUSB│◀──────▶│  server  │
 │  software  │        │        │ serial  │   + mbedTLS     │  TLS   │ (HTTPS…) │
 └────────────┘        └────────┘         └────────────────┘        └──────────┘
                       └─ cleartext serial ─┘ └──── TLS terminated here ────┘

LOCI is transparent with respect to TLS: it only ever handles already-decrypted bytes. Adding HTTPS required no change on the LOCI side — all the crypto lives in this firmware. Any USB-CDC-capable host benefits the same way.

TLS command summary

Reproduced from the README.md (§ TLS / HTTPS — authoritative, up-to-date version on GitHub).

← Documentation · AT command reference →