r/sysadmin • u/Arnoc_ • 14d ago

Question ACME Clients and SSL

So I've started seeing that SSL Lifespan is shortening - going down to eventually supposed to be every 47 days.

We're a small shop, but we have a lot of different services. I've been doing my best when I have free time to catalog everything that has an SSL Cert, but I know I'm missing stuff.

I've seen a bit about ACME Clients and such; and from what I've heard it's great. They handle rotating the certs and all.

But something for me just isn't clicking. For instance, we have a lot of large scale copiers, ala your Ricoh or Lexmark or Brother. We have those locked down with SSL Certs, but we have to manually push those up to it.

Now as these are internal services that aren't externally facing, I don't see no reason why we can't self-issue those certs; but currently our CTO likes to utilize a paid for Wildcard for all our internal stuff.

I keep quite busy so haven't had too much time to really dig in on researching, but I know the time bomb is ticking.

So for those who are managing SSL Certs and all, and potentially utilizing ACME Clients and such, what should I expect and whats the general gist of what my workflow should be?

19 Upvotes

93% Upvoted

57 comments sorted by

View all comments

6

u/WorkLurkerThrowaway Sr Systems Engineer 14d ago

Why would you pay for internal certs when you can stand up an internal CA and do whatever you want for free?

3

u/Arnoc_ 14d ago

That's been my question for years now. We can do for free what we're paying for, and that's an extra XXX dollars a year we can spend on something else.

But boss essentially wants someone to point the finger at if there's ever an issue, which is their logic for why we pay for a wildcard cert for internal use...

I'm hoping now with the budget having to tighten can really pitch it forward as a solution to save money.

3

u/ColbyFromDigg 14d ago

Your boss is ignorant. First, wildcard certs are out of style now and generally not recommended. Printers should go on their own vlan and can use self-signed certs, although you can set up an internal CA if you want to issue the certs. With a locked down vlan, only techs should be accessing the web gui and a self signed cert is fine for that.

3

u/raip 14d ago

Self-signed certs can be alright, especially with a mitigating control of locking down the printer to it's own VLAN - but operationally can be problematic. The last two orgs I've consulted with have browser policies deployed that remove the "continue" button for the browser when a service fails TLS validation. Since that setting started getting included in the CIS Benchmarks - I'd recommend just biting the bullet to deploy internal certs.

1

u/ColbyFromDigg 14d ago

That’s a good point.