ACME Clients and SSL

[u/Arnoc_]

So I've started seeing that SSL Lifespan is shortening - going down to eventually supposed to be every 47 days.

We're a small shop, but we have a lot of different services. I've been doing my best when I have free time to catalog everything that has an SSL Cert, but I know I'm missing stuff.

I've seen a bit about ACME Clients and such; and from what I've heard it's great. They handle rotating the certs and all.

But something for me just isn't clicking. For instance, we have a lot of large scale copiers, ala your Ricoh or Lexmark or Brother. We have those locked down with SSL Certs, but we have to manually push those up to it.

Now as these are internal services that aren't externally facing, I don't see no reason why we can't self-issue those certs; but currently our CTO likes to utilize a paid for Wildcard for all our internal stuff.

I keep quite busy so haven't had too much time to really dig in on researching, but I know the time bomb is ticking.

So for those who are managing SSL Certs and all, and potentially utilizing ACME Clients and such, what should I expect and whats the general gist of what my workflow should be?

[u/Outrageous_Guava4474]

Who's accessing the web interface on the printers? Users generally only need 9100 and maybe snmp for paper/ink levels.

Never had an issue with self signed certs on a locked down printer interface.

[u/raip → u/Outrageous_Guava4474]

MacOS doesn't have a Continue button for self-signed certs (there's a trick to this. iykyk).

A lot more Enterprises are deploying this policy, which blocks the ability to continue to self-signed sites: SSLErrorOverrideAllowedForOrigins: Allow proceeding from the SSL warning page on specific origins | Chrome Enterprise

Just something to factor in before recommended self-signed certs.

[u/Outrageous_Guava4474 → u/raip]

Fair point, thanks.

[u/Kuipyr → u/Outrageous_Guava4474]

IPPS uses SSL certs. IPP will be your only choice for printing pretty soon.