# Code Signing for FreeRTOS OTA

**URL:** <https://forums.freertos.org/t/code-signing-for-freertos-ota/22740>\
**Category:** Libraries\
**Tags:** aws-iot-core\
**Created:** [March 15, 2025, 11:35am UTC](https://forums.freertos.org/t/code-signing-for-freertos-ota/22740 "2025-03-15T11:35:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jhon](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@Jhon](https://forums.freertos.org/u/Jhon)\
**Post date:** [March 15, 2025, 11:35am UTC](https://forums.freertos.org/t/code-signing-for-freertos-ota/22740/1 "2025-03-15T11:35:40Z")

</div>

Hi Community,

I am using a **Nucleo STM32F446** with an **ESP32** (in AT mode) and referring to this guide:  
[FreeRTOS OTA Documentation](https://www.freertos.org/Documentation/03-Libraries/07-Modular-over-the-air-updates/02-Demos/02-mqtt-ota-agent-orchestrator).

In the FreeRTOS OTA job, under **“1. Create a code signing profile,”** it asks me to choose a device hardware platform.

What should I select for this? Is code signing necessary for OTA? How do I perform code signing?

Thanks!

---

<div class="post-metadata">

**Author:** ![aggarg](https://d3iykfbgfh8zhg.cloudfront.net/user_avatar/forums.freertos.org/aggarg/32/4245_2.png) [@aggarg](https://forums.freertos.org/u/aggarg)\
**Post date:** [March 16, 2025, 5:27pm UTC](https://forums.freertos.org/t/code-signing-for-freertos-ota/22740/2 "2025-03-16T17:27:40Z")

</div>

> [@Jhon](#):
>
> In the FreeRTOS OTA job, under **“1. Create a code signing profile,”** it asks me to choose a device hardware platform.

Assuming that your TLS stack can support SHA-256 and ECDSA, you can choose any of the ESP device and it should be okay. Which TLS stack are you using?

> [@Jhon](#):
>
> Is code signing necessary for OTA? How do I perform code signing?

We strongly recommend using code signing to ensure that devices only run code published by trusted authors and that the code hasn’t been changed or corrupted since it was signed. Here is the more detailed documentation: [What is AWS Signer? - AWS Signer](https://docs.aws.amazon.com/signer/latest/developerguide/Welcome.html). If you still want to send unsigned images (again, NOT RECOMMENDED) , you probably can use “Use my custom signed file” option.