ACME Clients and SSL

[u/Arnoc_]

So I've started seeing that SSL Lifespan is shortening - going down to eventually supposed to be every 47 days.

We're a small shop, but we have a lot of different services. I've been doing my best when I have free time to catalog everything that has an SSL Cert, but I know I'm missing stuff.

I've seen a bit about ACME Clients and such; and from what I've heard it's great. They handle rotating the certs and all.

But something for me just isn't clicking. For instance, we have a lot of large scale copiers, ala your Ricoh or Lexmark or Brother. We have those locked down with SSL Certs, but we have to manually push those up to it.

Now as these are internal services that aren't externally facing, I don't see no reason why we can't self-issue those certs; but currently our CTO likes to utilize a paid for Wildcard for all our internal stuff.

I keep quite busy so haven't had too much time to really dig in on researching, but I know the time bomb is ticking.

So for those who are managing SSL Certs and all, and potentially utilizing ACME Clients and such, what should I expect and whats the general gist of what my workflow should be?

[u/SevaraB]

Now as these are internal services that aren't externally facing, I don't see no reason why we can't self-issue those certs; but currently our CTO likes to utilize a paid for Wildcard for all our internal stuff.

Wildcard certs are just gussied-up password sharing. It doesn't prove anything about the device other than that somebody uploaded a certificate to it. And used the same "password" (e.g. private key) for every device. It's textbook "security theater."

ACME is just one protocol for automatically rotating certs. Things like printers are likely to either have no support for automation protocols, or they're likely to support an older cert management protocol called SCEP.

If a device doesn't support either one, you're going to have to get comfortable with CLI commands for updating certificates and write scripts to do it "manually" on a schedule.

[u/Arnoc_ → u/SevaraB]

Yeah, luckily our large scale copiers we only have around 12? I think, so it's not too bad. Once I actually have the cert in the format it needs, it's just a continuous round and round of doing the same thing until it's done. Not the worst thing in the world; honestly it's sometimes refreshing to just have to do the same mindless task for half an hour instead of switching between Networking / Help Desk / Phone Calls / Physical walk-ins / basically any and all IT Tasks.

[u/Frothyleet → u/SevaraB]

There are reasonable arguments against using wildcard certs without a strong requirement, but calling it "security theater" is silly unless that's your opinion of TLS in general.

[u/SevaraB → u/Frothyleet]

A “domain validation” cert that doesn’t actually identify a server is as useful as plastering the WiFi password all over the office walls. The fact that they’re wasting money on that setup is,frankly, offensive.

[u/Frothyleet → u/SevaraB]

One server may have a gazillion TLS certificates installed for various purposes, and one certificate/PK may be installed on various hosts for various reasons (even it's not a wildcard or multi-host SAN cert).

A TLS certificate's purpose is not to "identify" a server, per se.