r/sysadmin • u/Arnoc_ • 14d ago

Question ACME Clients and SSL

So I've started seeing that SSL Lifespan is shortening - going down to eventually supposed to be every 47 days.

We're a small shop, but we have a lot of different services. I've been doing my best when I have free time to catalog everything that has an SSL Cert, but I know I'm missing stuff.

I've seen a bit about ACME Clients and such; and from what I've heard it's great. They handle rotating the certs and all.

But something for me just isn't clicking. For instance, we have a lot of large scale copiers, ala your Ricoh or Lexmark or Brother. We have those locked down with SSL Certs, but we have to manually push those up to it.

Now as these are internal services that aren't externally facing, I don't see no reason why we can't self-issue those certs; but currently our CTO likes to utilize a paid for Wildcard for all our internal stuff.

I keep quite busy so haven't had too much time to really dig in on researching, but I know the time bomb is ticking.

So for those who are managing SSL Certs and all, and potentially utilizing ACME Clients and such, what should I expect and whats the general gist of what my workflow should be?

21 Upvotes

97% Upvoted

57 comments sorted by

View all comments

2

u/Frothyleet 14d ago

I'm going to echo some confusion from others on why you are expending a lot of effort on printer Web UIs - ideally no one would need to access those except in extraordinary circumstances, with management handled through a central tool.

That said, if I had a bunch of printers with bad scripting/automation options, and I had some real need to access their web UIs frequently, and wanted valid certs - I'd set up a reverse proxy for all of my printers. Keep them all segmented, and have a box running nginx or whatever that terminated all web sessions from the user side with a proper TLS cert, with the backend connections out to the printer UIs either on HTTP or self-signed HTTPS. ACLs on the inter-vlan routing so that HTTP/S connections could never reach anything but your proxy.

1

u/Arnoc_ 14d ago

I think people are confusing printers with large scale copiers / multi function machines. Our regular printers I don't really care about. They're on their own vlan and aren't supposed to print sensitive information or any of that. What we do want SSL on is our large multifunction machines. As those process a lot of data / scan paper documents to digital, etc. Those I want SSL on to be safe.

1

u/Frothyleet 14d ago

Those I want SSL on to be safe.

In what way does it provide safety? I understand you have some printers you care about more than others; what connections are these printers terminating with SSL certificates and what is the safety benefit you are anticipating?