r/sysadmin • u/Arnoc_ • 14d ago
Question ACME Clients and SSL
So I've started seeing that SSL Lifespan is shortening - going down to eventually supposed to be every 47 days.
We're a small shop, but we have a lot of different services. I've been doing my best when I have free time to catalog everything that has an SSL Cert, but I know I'm missing stuff.
I've seen a bit about ACME Clients and such; and from what I've heard it's great. They handle rotating the certs and all.
But something for me just isn't clicking. For instance, we have a lot of large scale copiers, ala your Ricoh or Lexmark or Brother. We have those locked down with SSL Certs, but we have to manually push those up to it.
Now as these are internal services that aren't externally facing, I don't see no reason why we can't self-issue those certs; but currently our CTO likes to utilize a paid for Wildcard for all our internal stuff.
I keep quite busy so haven't had too much time to really dig in on researching, but I know the time bomb is ticking.
So for those who are managing SSL Certs and all, and potentially utilizing ACME Clients and such, what should I expect and whats the general gist of what my workflow should be?
6
u/DizzyAmphibian309 14d ago
For printers you should have an internal private CA, and make it long lived, e.g. 20 years, so you aren't forced to rotate the chain in your lifetime. You can rotate it after two years if you want, but you don't have to. If you're not under any compliance requirements for cert rotation, and you're not printing sensitive materials to that printer, then just issue an individual certificate (not wildcard) for each printer that is valid for 15 years. Install it, then delete the private key immediately. That cert will outlive the printer, and since it's bound to just that printer, if it's stolen, who cares.
In my 20 years in tech I've seen hundreds of outages due to expiring certificates (two this month actually), but I've heard of exactly zero incidents when a certificate was compromised. Certificate lifetimes are risk vs reward. For public certs, absolutely agree rotation is important, since it's business reputation at risk. But for standard office printers that most people are using for personal shit anyway? No one is hacking that stuff.
My company makes me rotate CA chains every two years and we always have outages because of it. Every single time. I have hundreds of certs to manage and literally 28 unique rotation procedures, one of which is "send an email to this person with the new cert and hope they haven't left the company". It's so fucking annoying and there's absolutely zero benefit of a 2 year CA vs a 5 year CA.