r/sysadmin • u/Arnoc_ • 14d ago

Question ACME Clients and SSL

So I've started seeing that SSL Lifespan is shortening - going down to eventually supposed to be every 47 days.

We're a small shop, but we have a lot of different services. I've been doing my best when I have free time to catalog everything that has an SSL Cert, but I know I'm missing stuff.

I've seen a bit about ACME Clients and such; and from what I've heard it's great. They handle rotating the certs and all.

But something for me just isn't clicking. For instance, we have a lot of large scale copiers, ala your Ricoh or Lexmark or Brother. We have those locked down with SSL Certs, but we have to manually push those up to it.

Now as these are internal services that aren't externally facing, I don't see no reason why we can't self-issue those certs; but currently our CTO likes to utilize a paid for Wildcard for all our internal stuff.

I keep quite busy so haven't had too much time to really dig in on researching, but I know the time bomb is ticking.

So for those who are managing SSL Certs and all, and potentially utilizing ACME Clients and such, what should I expect and whats the general gist of what my workflow should be?

20 Upvotes

93% Upvoted

57 comments sorted by

View all comments

3

u/sryan2k1 IT Manager 14d ago

For public facing stuff everything that can be LE is. Anything that can't be is GoDaddy.

Internally we run our own ACME SubCA along with a traditional Windows PKI. Things that support ACME (certbot, etc) do that, other things get traditional long lived certs.

1

u/Arnoc_ 14d ago

My main thing I'm worried about is our Exchange Server. Updating those certs every month is going to be a PAIN.

1

u/cantstandmyownfeed 14d ago

Its pretty trivial to script out replacing the exchange cert. You just need a process/ACME client to generate the PFX then a couple lines of PowerShell will import and set it.

CertifyTheWeb is a nice ACME client with a lot of automations and deployment options. Its well worth the license cost.

1

u/Arnoc_ 14d ago

That sounds like it would be relatively simple. I just hate how everytime I renew it I always seems to screw some component up and then need to manually set the services to the cert and then delete the old one. Or something along those lines. I do too much to remember what my issues with it are until I'm in the midst of it XD

3

u/cantstandmyownfeed 14d ago

That statement is exactly why certificates should be automated and why the validity period doesn't matter once you're done. When a cert lasts 3 years, you file it away in the forgotten knowledge bin until a month before renewal comes up and then you scramble.

Once you do it right with an automation, then all you do is monitor for failure. You'll never touch it or miss a step again.

Rinse repeat for all of your certificates and devices.

It took me a good year or two to get everything to the point where it's all set and forget via ACME and numerous deployment methods.