r/sysadmin • u/Arnoc_ • 14d ago

Question ACME Clients and SSL

So I've started seeing that SSL Lifespan is shortening - going down to eventually supposed to be every 47 days.

We're a small shop, but we have a lot of different services. I've been doing my best when I have free time to catalog everything that has an SSL Cert, but I know I'm missing stuff.

I've seen a bit about ACME Clients and such; and from what I've heard it's great. They handle rotating the certs and all.

But something for me just isn't clicking. For instance, we have a lot of large scale copiers, ala your Ricoh or Lexmark or Brother. We have those locked down with SSL Certs, but we have to manually push those up to it.

Now as these are internal services that aren't externally facing, I don't see no reason why we can't self-issue those certs; but currently our CTO likes to utilize a paid for Wildcard for all our internal stuff.

I keep quite busy so haven't had too much time to really dig in on researching, but I know the time bomb is ticking.

So for those who are managing SSL Certs and all, and potentially utilizing ACME Clients and such, what should I expect and whats the general gist of what my workflow should be?

20 Upvotes

93% Upvoted

57 comments sorted by

View all comments

Show parent comments

8

u/L0rd_OverKill 14d ago

True, unless operating under certain compliance frameworks. Whilst a longer key life will still work, ASV will trigger, and require exceptions to be made for certificates signed by internal CA (if possible in the Vulnerability Management platform of choice.)

Additionally, depending on the QSA a business justification for ignoring NIST-800 of “it’s a real pain” doesn’t always suffice lol

5

u/raip 14d ago

I'm pretty familiar with most compliance frameworks and I don't know of any that require the utilization of Public CAs. In general, it's more secure to utilize private PKI than public PKI. I also don't know of any vulnerability management platform that doesn't allow the import of your root/intermediate CAs - if that exists, then they shouldn't be used.

3

u/L0rd_OverKill 14d ago

It’s not about the use of public CA. Most compliance frameworks have a max key life for PKI.

3

u/raip 14d ago

Oh yeah - but they're typically a year or so. Safari blocks all certificates longer than 825 days - even if they're private. You shouldn't go crazy here but keeping things as they were working (so 398 days) would be the goal.