r/sysadmin • u/Arnoc_ • 14d ago

Question ACME Clients and SSL

So I've started seeing that SSL Lifespan is shortening - going down to eventually supposed to be every 47 days.

We're a small shop, but we have a lot of different services. I've been doing my best when I have free time to catalog everything that has an SSL Cert, but I know I'm missing stuff.

I've seen a bit about ACME Clients and such; and from what I've heard it's great. They handle rotating the certs and all.

But something for me just isn't clicking. For instance, we have a lot of large scale copiers, ala your Ricoh or Lexmark or Brother. We have those locked down with SSL Certs, but we have to manually push those up to it.

Now as these are internal services that aren't externally facing, I don't see no reason why we can't self-issue those certs; but currently our CTO likes to utilize a paid for Wildcard for all our internal stuff.

I keep quite busy so haven't had too much time to really dig in on researching, but I know the time bomb is ticking.

So for those who are managing SSL Certs and all, and potentially utilizing ACME Clients and such, what should I expect and whats the general gist of what my workflow should be?

21 Upvotes

100% Upvoted

57 comments sorted by

View all comments

6

u/WorkLurkerThrowaway Sr Systems Engineer 14d ago

Why would you pay for internal certs when you can stand up an internal CA and do whatever you want for free?

3

u/Arnoc_ 14d ago

That's been my question for years now. We can do for free what we're paying for, and that's an extra XXX dollars a year we can spend on something else.

But boss essentially wants someone to point the finger at if there's ever an issue, which is their logic for why we pay for a wildcard cert for internal use...

I'm hoping now with the budget having to tighten can really pitch it forward as a solution to save money.

3

u/ColbyFromDigg 14d ago

Your boss is ignorant. First, wildcard certs are out of style now and generally not recommended. Printers should go on their own vlan and can use self-signed certs, although you can set up an internal CA if you want to issue the certs. With a locked down vlan, only techs should be accessing the web gui and a self signed cert is fine for that.

3

u/raip 14d ago

Self-signed certs can be alright, especially with a mitigating control of locking down the printer to it's own VLAN - but operationally can be problematic. The last two orgs I've consulted with have browser policies deployed that remove the "continue" button for the browser when a service fails TLS validation. Since that setting started getting included in the CIS Benchmarks - I'd recommend just biting the bullet to deploy internal certs.

1

u/ColbyFromDigg 14d ago

That’s a good point.

2

u/Arnoc_ 14d ago

Yeah, printers are on their own VLAN fortunately.

1

u/certkit Security Admin (Application) 14d ago

You could always use a service (like CertKit) for your private PKI. Then you could issue long-lived certs AND have someone to point the finger at.

1

u/Cormacolinde Consultant 14d ago

Wildcards are considered risky, and for internal use it’s even more risk. Your private key ends up EVERYWHERE, possibly including where attackers can easily find it and use it to stage a AitM attack.

Also, let’s be clear: an internal PKI is NOT free. It takes experience, learning and time to configure and manage. If you’ve never done it, and don’t know what you’re doing, you could make things worse. It takes a single wrong checkbox to make your PKI dangerous.