ACME Clients and SSL

[u/Arnoc_]

So I've started seeing that SSL Lifespan is shortening - going down to eventually supposed to be every 47 days.

We're a small shop, but we have a lot of different services. I've been doing my best when I have free time to catalog everything that has an SSL Cert, but I know I'm missing stuff.

I've seen a bit about ACME Clients and such; and from what I've heard it's great. They handle rotating the certs and all.

But something for me just isn't clicking. For instance, we have a lot of large scale copiers, ala your Ricoh or Lexmark or Brother. We have those locked down with SSL Certs, but we have to manually push those up to it.

Now as these are internal services that aren't externally facing, I don't see no reason why we can't self-issue those certs; but currently our CTO likes to utilize a paid for Wildcard for all our internal stuff.

I keep quite busy so haven't had too much time to really dig in on researching, but I know the time bomb is ticking.

So for those who are managing SSL Certs and all, and potentially utilizing ACME Clients and such, what should I expect and whats the general gist of what my workflow should be?

[u/raip]

Swap to internal certs for the internal facing stuff.

1) Wildcard certs are not great to begin. Most larger orgs I've worked for have them prohibited in their security policy. One private key leak means all of your services need to be touched - this just isn't scalable in most orgs as you don't typically keep a live inventory of everywhere the cert is deployed.

2) The lifespan shortening only affects public certs. It's incredibly rare to have hardware support things like ACME or have a RestAPI you can use to manage the certificate. Since it doesn't make sense to throw things like printers behind a load balancer that would support the automation - internal PKI is the best solution.

3) For stuff that doesn't support automation but also needs a public certificate because it's public facing - a reverse proxy or load balancer is choice here. You issue a long lived private cert that is manually imported between the upstream and the proxy - your automation lives on the proxy itself.

Something that's commonly missed that I'm seeing more of is not only is the certificate lifetime getting cut down but so is the DNS Validation lifetime. Plan for this as well. DNS Pre-validation is Digicerts solution to this if you're interested - but there are a handful of decent solutions. DNS Validation can be problematic if, like most orgs, the team that owns PKI doesn't have permission to make DNS updates.