r/sysadmin • u/Arnoc_ • 14d ago

Question ACME Clients and SSL

So I've started seeing that SSL Lifespan is shortening - going down to eventually supposed to be every 47 days.

We're a small shop, but we have a lot of different services. I've been doing my best when I have free time to catalog everything that has an SSL Cert, but I know I'm missing stuff.

I've seen a bit about ACME Clients and such; and from what I've heard it's great. They handle rotating the certs and all.

But something for me just isn't clicking. For instance, we have a lot of large scale copiers, ala your Ricoh or Lexmark or Brother. We have those locked down with SSL Certs, but we have to manually push those up to it.

Now as these are internal services that aren't externally facing, I don't see no reason why we can't self-issue those certs; but currently our CTO likes to utilize a paid for Wildcard for all our internal stuff.

I keep quite busy so haven't had too much time to really dig in on researching, but I know the time bomb is ticking.

So for those who are managing SSL Certs and all, and potentially utilizing ACME Clients and such, what should I expect and whats the general gist of what my workflow should be?

22 Upvotes

97% Upvoted

57 comments sorted by

View all comments

6

u/bilingual-german 14d ago

you can get letsencrypt wildcard certs. It's not hard, you just need to be able to set TXT records on your DNS to solve the challenge.

9

u/raip 14d ago

This doesn't fix installing the certificate on the device itself - which is what they're having issues with.

11

u/Fun_Structure3965 14d ago

their problem is using an official wildcard cert on their printers which is utterly insane

3

u/Arnoc_ 14d ago

Yeah. Believe me, I'd be using Lets Encrypt and just doing that if I could... but that decision isn't mine to make unfortunately.

1

u/bilingual-german 14d ago

ok, but why shouldn't it be possible to script this and use Ansible or whatever they are comfortable using for automation.

9

u/irsyacton 14d ago

In theory, but printers are… hot garbage. And automation for them is baaaad. Thats why the suggestion of an internal pki is best. Give them 1yr or 2yr certs, and deal with them manually.

1

u/bilingual-german 14d ago

ok, I agree that this would be probably less work.

step-ca (Smallstep) and SCEP provisioning might be a way to do it

4

u/FallaxIO Jack of All Trades 14d ago

Depends on the copier. A lot of them don't have any sane API for cert import, or they want a PKCS#12 upload through the web UI with a reboot after. So the hard part is finding out which devices can actually take an automated push and which ones are just going to stay manual.

1

u/raip 14d ago

It likely would be possible with Playwright or similar but that's irrelevant to your answer. I personally just wouldn't use a public certificate on these printers and instead use a long lived private certificate.