4 ms·

Has anyone got a good way of managing certificates in the wild? With no real management and staff turnover I've seen a bunch of expired certificate problems. E

by rb808 9y ago

Has anyone got a good way of managing certificates in the wild? With no real management and staff turnover I've seen a bunch of expired certificate problems. EDIT: presumably you need your client apps/libraries in the field write back when they use a cert that is <X months away from expiry.

judge2020 9y ago
I'd say someone very high up and "tied to the company", probably the CTO, should make sure a signing certificate is renewed when needed and make sure it's rotated every time it's about to hit expiration. For a company as big as oculus with the backing of Facebook, this is a pretty big issue.
- toomuchtodo 9y ago
  I’d expect at Facebook’s scale, they’d have a PKI management team, and this would’ve gone through their certificate lifecycle management process.
- epberry 9y ago
  I think the CTOs role here would probably be to make sure a process or team is in place to do this but not actually do it themselves? (For a company the size of oculus)
draw_down 9y ago
Monitors
ahelwer 9y ago
You can use secret management systems like Azure Key Vault to auto-roll/renew secrets, but your applications have to be built to use such systems. (disclaimer: work for Azure, but not on Key Vault)
- gambler 9y ago
  Feudal security at its best.
- cheeze 9y ago
  Never trust somebody else to make sure your certificate is renewed. Case in point: Even Azure had a huge outage due to cert issues (abeit quite a bit more complicated than a simple expiration, but my point here is that certificates are hard.)
jlgaddis 9y ago
Define "managing"? I use simple Nagios checks for keeping an eye on certificate expiration. It's simple to set up checks for new hosts/services and I have them set to trigger an e-mail alert 30 days before expiration (20 days for certificates from Let's Encrypt). It does the job; I have yet to wake up one day to an expired certificate. Apparently, this ("send me an e-mail before my certificate expires") is also the sole reason some companies even exist (i.e., it is their only product/service). It amazes me that this is something folks will pay for.
- jandrese 9y ago
  What happens when you leave for a different job or get hit by a bus? More than one cert has expired because the guy who was maintaining them moved on and nobody else knew how to keep them up to date. Obviously it should be part of a handoff process when you leave, but companies aren't always good at smoothly handling transitions like this.
  - jlgaddis 9y ago
    I've been hit by a bus! Well, a Jeep Cherokee, technically, but I was on a motorcycle so it felt like a bus. I was off work for ~4 months -- couldn't even walk for the first three and could barely feed myself. We managed, though. We got by and didn't have any SHTF moments in my absence. What happens if I leave, though? I don't know and, TBH, I won't really care; it won't be my problem at that point. How -- if -- things are handed off or transferred off to someone else when I leave will be up to my boss, I suppose.
- rb808 9y ago
  I think 30 days might not be enough - maybe its best to create a new certificate every build or every month.

by rb808 9y ago

judge2020 9y ago

I'd say someone very high up and "tied to the company", probably the CTO, should make sure a signing certificate is renewed when needed and make sure it's rotated every time it's about to hit expiration. For a company as big as oculus with the backing of Facebook, this is a pretty big issue.

toomuchtodo 9y ago
I’d expect at Facebook’s scale, they’d have a PKI management team, and this would’ve gone through their certificate lifecycle management process.
epberry 9y ago
I think the CTOs role here would probably be to make sure a process or team is in place to do this but not actually do it themselves? (For a company the size of oculus)

draw_down 9y ago

Monitors

ahelwer 9y ago

You can use secret management systems like Azure Key Vault to auto-roll/renew secrets, but your applications have to be built to use such systems. (disclaimer: work for Azure, but not on Key Vault)

gambler 9y ago
Feudal security at its best.
cheeze 9y ago
Never trust somebody else to make sure your certificate is renewed. Case in point: Even Azure had a huge outage due to cert issues (abeit quite a bit more complicated than a simple expiration, but my point here is that certificates are hard.)

jlgaddis 9y ago

Define "managing"? I use simple Nagios checks for keeping an eye on certificate expiration. It's simple to set up checks for new hosts/services and I have them set to trigger an e-mail alert 30 days before expiration (20 days for certificates from Let's Encrypt). It does the job; I have yet to wake up one day to an expired certificate. Apparently, this ("send me an e-mail before my certificate expires") is also the sole reason some companies even exist (i.e., it is their only product/service). It amazes me that this is something folks will pay for.

jandrese 9y ago
What happens when you leave for a different job or get hit by a bus? More than one cert has expired because the guy who was maintaining them moved on and nobody else knew how to keep them up to date. Obviously it should be part of a handoff process when you leave, but companies aren't always good at smoothly handling transitions like this.
- jlgaddis 9y ago
  I've been hit by a bus! Well, a Jeep Cherokee, technically, but I was on a motorcycle so it felt like a bus. I was off work for ~4 months -- couldn't even walk for the first three and could barely feed myself. We managed, though. We got by and didn't have any SHTF moments in my absence. What happens if I leave, though? I don't know and, TBH, I won't really care; it won't be my problem at that point. How -- if -- things are handed off or transferred off to someone else when I leave will be up to my boss, I suppose.
rb808 9y ago
I think 30 days might not be enough - maybe its best to create a new certificate every build or every month.