Live Data
Real-time sensor readings from connected nodes
Time Range:
Waiting for data...
Connect your MQTT device to see live data
Connect your MQTT device to see live data
System Logs
Raw MQTT messages and system events
Historical Data
Query and visualize saved measurements
Metrics:
🛡️ ESP32 Secure OTA Manager
Deploy cryptographically signed firmware over W5500 Ethernet
🔒 Transport: HTTPS + CA Pinning
🔑 Authenticity: Secure Boot V2 (RSA-3072)
🛡️ Storage: AES-256-XTS Flash Encryption
⏳ Lifecycle: Anti-Rollback Counter
💾 Recovery: Dual Partition (ota_0 / ota_1)
1. Upload Signed Firmware (.bin)
📁
Drag & drop signed ESP32 binary or
Validates ESP32 Header (0xE7), app descriptor (0xABCD5432) & SHA256
2. Target Node & Deployment
OTA Progress: Idle
IDLE
1. Trigger
2. Download
3. Verify
4. Flash
5. Reboot & Validate
0%
📖 Secure OTA Technical Manual & Deployment Workflow
Complete reference for compiling, validating, staging, and deploying firmware binaries wirelessly over Ethernet
⚙️
1. Arduino IDE Compilation & Binary Export
- Open
ESP32_EXAMPLE/ESP32_EXAMPLE.inoin Arduino IDE. - Configure your network credentials, MQTT credentials, and PZEM channel names in
secrets.h. - Go to Tools -> Board and select
ESP32 Dev Module(or your specific ESP32 variant). - Go to Tools -> Partition Scheme and select
Minimal SPIFFS (1.9MB APP with OTA). This ensures dualota_0andota_1partitions are created. - Compile and export binary: Select Sketch -> Export Compiled Binary (Shortcut:
Ctrl + Alt + S). - Locate the compiled
.binfile in your sketch'sbuild/directory.
🛡️
2. Dual-Partition Architecture & Anti-Bricking
- Partition Slots (ota_0 / ota_1): The ESP32 flash memory divides application space into two identical slots (~1.9 MB each).
- Zero-Downtime Download: The currently active partition continues executing your meter sampling loop without interruption while chunked firmware data streams into the passive partition.
- Power & Network Loss Resiliency: If an update is interrupted by a power brownout or Ethernet disconnect, the bootloader cancels the staging process and reboots safely into the original active partition. Your board can never be bricked by a bad transfer.
- Rollback Validation: Upon first boot of new firmware,
SecureOTA.cppverifies sensor loop stability before marking the partition permanently valid.
🔐
3. Multi-Layer Binary Validation Protocol
- ESP32 Header Magic Byte: Verifies
0xE7 0xFEheader to prevent flashing non-ESP32 files or corrupted data. - ESP-IDF App Descriptor: Reads segment offsets, entry point addresses, and compile timestamps from the image header (offset
0x20). - Streaming SHA-256 Checksum: As packets stream into flash over W5500 Ethernet, an on-the-fly SHA-256 digest is computed and matched against the server hash.
- Anti-Rollback Counter (SecVer): Compares firmware security version against internal eFuse / NVS counters. Downgrade attempts to older vulnerable binaries are automatically rejected.
- Session HMAC Tokens: MQTT trigger commands require time-bound cryptographic HMAC signatures generated by the Express server.
💡
4. Staging, Deployment & Troubleshooting
- Staging & Validation: Drag & drop your
.binfile into Step 1 above. The web app validates binary magic bytes, calculates SHA-256, and extracts version details before staging. - Target Device Selection: Always test deployment on a single target ESP32 node (e.g.
Main_Panel_1) first before using the All Connected Nodes (Broadcast) option. - Live Telemetry Tracking: Monitor progress in real time on the progress bar and log box above. ESP32 devices report progress percentages back over MQTT (
sensor/pzem/+/ota/status). - Serial Monitor Debugging: Connect an FTDI / USB cable at
115200 baudto observe live bootloader logs:[SecureOTA] Active Partition: ota_0 | Validated.
Active Nodes
Connected: 0