# Secure Webhook ESP8266

**URL:** <https://community.homey.app/t/secure-webhook-esp8266/51106>\
**Category:** Apparaten\
**Tags:** app\
**Created:** [September 3, 2021, 2:24pm UTC](https://community.homey.app/t/secure-webhook-esp8266/51106 "2021-09-03T14:24:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bos](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/bos/32/8527_2.png) [@Bos](https://community.homey.app/u/Bos)\
**Post date:** [September 3, 2021, 2:24pm UTC](https://community.homey.app/t/secure-webhook-esp8266/51106/1 "2021-09-03T14:24:47Z")

</div>

Hi,

I’m currently using the Logic app to create a secure webhook over the internet to start a flow remotely. I succeeded to connecting my ESP8266 board to the homey using the Logic app and the fingerprint of [xxxxxx.connect.athom.com](http://xxxxxx.connect.athom.com).

The problem is that the Amazon cetrificate will be renewed on 09-12-2021 and i’m unable to reprogram the fingerprint my ESP8266 remotely.

Question: Is there another way to make a secure webhook connection avoiding the certificate renewal?

regards Menne

---

<div class="post-metadata">

**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\
**Post date:** [September 4, 2021, 7:27am UTC](https://community.homey.app/t/secure-webhook-esp8266/51106/2 "2021-09-04T07:27:37Z")

</div>

You don’t want to rely on the fact that the website you connect to has a valid certificate for the `athom.com` domain? These days, server certificates are pretty transient (Let’s Encrypt certs last for only a couple of months) so you can’t rely on them staying the same during the lifetime of your device.

Perhaps using a unique identifier for `<event>` and/or `<tag>` in your request is an option? You’d have to change your flow to validate these before continuing.

---

<div class="post-metadata">

**Author:** ![Bos](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/bos/32/8527_2.png) [@Bos](https://community.homey.app/u/Bos)\
**Post date:** [September 4, 2021, 1:14pm UTC](https://community.homey.app/t/secure-webhook-esp8266/51106/3 "2021-09-04T13:14:29Z")

</div>

Thanks Robert for explaining. It seems difficult to implement a long time solution in a ESP8266. I will do some digging in the BearSSL library that makes the MCU act more as a website by checking the cert against the different stored roots.

Your idea on the tag is a good idea, I can use some kind of complex code.

Still open question: Is there another way to connect securely to the Homey over the internet without using the fingerprint?

---

<div class="post-metadata">

**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\
**Post date:** [September 4, 2021, 2:03pm UTC](https://community.homey.app/t/secure-webhook-esp8266/51106/4 "2021-09-04T14:03:40Z")

</div>

> [@Bos](#):
>
> Still open question: Is there another way to connect securely to the Homey over the internet without using the fingerprint?

Can you define “securely”?