BLE Secure GATT Server and Client Bring-Up on ESP32-C6

The ESP32-C6 combines Bluetooth 5.0 Low Energy (LE) and Wi-Fi 6, making it a compelling platform for secure wireless communication. In this guide, we’ll set up a secure GATT Server and Client using Espressif’s ESP-IDF SDK. We’ll also walk through the required partition table update for large binaries.

What You’ll Need

• 2× ESP32-C6 Dev Boards (e.g., ESP32-C6-DevKitC-1)
• USB-C cables
• ESP-IDF (v5.1+)
• Python 3.9+
• Terminal or VS Code with ESP-IDF extension

⚙️ Step 1: Install and Configure ESP-IDF

git clone --recursive https://github.com/espressif/esp-idf.git
cd esp-idf
git checkout v5.1.2
./install.sh esp32c6
. ./export.sh

Set the chip target:

idf.py set-target esp32c6

📁 Step 2: Locate the Secure BLE Examples

ESP-IDF includes secure GATT examples under:

• Server: esp-idf/examples/bluetooth/bluedroid/ble_50/ble50_security_server
• Client: esp-idf/examples/bluetooth/bluedroid/ble_50/ble50_security_client

Make a working copy (optional):

mkdir -p ~/esp-secure-ble
cp -r $IDF_PATH/examples/bluetooth/bluedroid/ble_50/ble50_security_server ~/esp-secure-ble/
cp -r $IDF_PATH/examples/bluetooth/bluedroid/ble_50/ble50_security_client ~/esp-secure-ble/

🧠 Step 3: Understand Project Structure

🔐 Server Project Layout

Path: ble50_security_server/main/

ble50_sec_gatts_demo.c      // Main logic for secure GATT server
ble50_sec_gatts_demo.h      // Header declarations
CMakeLists.txt              // Build integration
Kconfig.projbuild           // Optional build-time config

The server uses LE Secure Connections with MITM protection, and can advertise securely using extended advertising (BLE 5.0+).

🔗 Client Project Layout

Path: ble50_security_client/main/

ble50_sec_gattc_demo.c      // GATT client logic: scan, connect, read/write
CMakeLists.txt              // Build script
Kconfig.projbuild           // Optional flags

The client scans for the server and initiates secure pairing using Just Works or Numeric Comparison depending on IO capabilities.

🧱 Step 4: Partition Table Fix (Required)

By default, the secure server binary may overflow the factory partition. To fix this:

✅ Create a partitions.csv file in both project roots:

# Name,     Type, SubType, Offset,   Size
nvs,        data, nvs,     0x9000,   0x7000
otadata,    data, ota,     0x10000,  0x2000
factory,    app,  factory, 0x20000,  0x1E0000

This increases the app partition to ~1.875 MB.

⚙️ Enable Custom Partition Table via Menuconfig

idf.py menuconfig

Navigate to:

Partition Table → (X) Custom partition table CSV → (partitions.csv)

🧪 Step 5: Build and Flash

🖥 Terminal 1 — GATT Server

cd ~/esp-secure-ble/ble50_security_server
idf.py set-target esp32c6
idf.py build flash monitor -p /dev/tty.usbmodemXXXX

🖥 Terminal 2 — GATT Client

cd ~/esp-secure-ble/ble50_security_client
idf.py set-target esp32c6
idf.py build flash monitor -p /dev/tty.usbmodemYYYY

🔐 Step 6: Security Configuration

Server Setup

Key security params in ble50_sec_gatts_demo.c:

esp_ble_auth_req_t auth_req = ESP_LE_AUTH_REQ_SC_MITM_BOND;
esp_ble_io_cap_t iocap = ESP_IO_CAP_IO;
esp_ble_gap_set_security_param(ESP_BLE_SM_AUTHEN_REQ_MODE, &auth_req, sizeof(uint8_t));
esp_ble_gap_set_security_param(ESP_BLE_SM_IOCAP_MODE, &iocap, sizeof(uint8_t));

This enables:

• LE Secure Connections (LESC)
• MITM Protection
• Bonding

Client Setup

In ble50_sec_gattc_demo.c, the client scans, connects, pairs, and reads from characteristics:

esp_ble_gap_start_scanning(30);
esp_ble_gattc_open(...);
esp_ble_gattc_read_char(...);

🔍 Optional: Enable MTU Negotiation

Enable higher throughput:

esp_ble_gattc_send_mtu_req(...);
esp_ble_gatts_set_local_mtu(...);

🧼 Step 7: Erase Bonded Devices

idf.py erase-flash

Or from code:

esp_ble_remove_bond_device(bda);

✅ Expected Logs

📊 Summary Table

🧭 Where to Go Next?

You can extend this setup to support:

• BLE Mesh provisioning
• Secure OTA updates
• BLE → Wi-Fi bridging via Blufi

✨ Conclusion

You now have a fully functional BLE 5.0 Secure Connection stack running on the ESP32-C6 using GATT Server/Client roles. This project can serve as a building block for secure IoT solutions, access control, or wearable communication systems.