8 ms·
Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days. If your vendor device or software doesn't support automa
by dharmab 6y ago
Buy a domain, create a subdomain for local use, and issue ACME certs with Let's Encrypt every 60 days.
If your vendor device or software doesn't support automated certificate rotation, put nginx/haproxy/envoy in front of it.
- xg15 6y agoWithout buying a domain. (and continously spending money to keep it owned)
- dharmab 6y agoRun your own CA internally and handle the CA distribution problem with MDM tools.
- lawnchair_larry 6y agoThat is also an insane and unrealistic suggestion.
- xg15 6y agoI admit, that's a solution, even if a very unpleasant one: Installing a custom root CA is intentionally complicated, so this is hardly doable as an onboarding experience. The setup must be repreated for every single client device that should access the server. There remains the question how I would get the CA certificate onto client devices in the first place. Lastly, with asking consumers to install a CA certificate, I ask for a significantly more powerful permission than if I could just have them trust my certificate. This seems like a step backwards security-wise.
- est31 6y ago> Lastly, with asking consumers to install a CA certificate, I ask for a significantly more powerful permission than if I could just have them trust my certificate. CA certificates can be constrained. https://tools.ietf.org/html/rfc5280#section-4.2.1.10 https://tools.ietf.org/html/rfc5280#section-4.2.1.10
- toast0 6y agoAre common certificate validation libraries honoring these constraints? When I tried to use this many moons ago, most things ignored the constraints; although I could mark the extension critical, and then some (but not all, yay) of the things that didn't understand would refuse the CA.
- namibj 6y agoCan you name and shame those that ignored the critical extension? Sounds CVE-worthy. A date to guess the versions you used would also help.
- toast0 6y agoNo, it was on the order of 5 years ago; everybody was garbage back then. But, if this had become usable, I would expect to have seen articles about using it since then.
- est31 6y agoIDK NSS seems to have code to verify it: https://searchfox.org/mozilla-central/source/security/nss/lib/mozpkix/lib/pkixnames.cpp#285 https://searchfox.org/mozilla-central/source/security/nss/li... As does webpki: https://github.com/briansmith/webpki/blob/482627c40dad2148da8b9bf64c2c781ea30a7e4d/src/name.rs#L158 https://github.com/briansmith/webpki/blob/482627c40dad2148da... But haven't tested it (or checked other libraries).
- est31 6y agoUpdate: tested it with openssl and webpki. both claim to have support but it only works with openssl. For webpki I had to file two bugs: https://github.com/briansmith/webpki/issues/134 https://github.com/briansmith/webpki/issues/134 https://github.com/briansmith/webpki/issues/135 https://github.com/briansmith/webpki/issues/135
- loeg 6y agoHow do you actually generate a constrained CA certificate? I have tried to do this for a long time but openssl is inscrutable.
- p2t2p 6y agoIt is no more complicated than a self signed certificate. Two clicks in Firefox, 4 taps in iOS
- elcritch 6y agoEvery time and no tracking if device indentity changes.
- demersb 6y ago~$5/year (US) for a domain, and a one time investment of setting up a few scripts might save you a lot of time in the long run.
- xg15 6y agoHonestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore. Even if my device is purely for LAN use and wouldn't need the internet at all, I now need to ensure it has an internet connection and I have to keep a domain owned that must be constantly renewed. The device will also only be accessible if an internet connection is present, even if both the device and the client are in the same LAN - because the client has to access the device through the domain. This means, should I ever lose the capacity to support the device and renew the domain, the device will become useless, even if technically, it is still completely functional.
- gsich 6y agoNo. Your DNS can also be locally, so you have no Internet dependence.
- p2t2p 6y ago> Honestly, my main issue is not even the price, it's that devices cannot be stand-alone anymore. That’s not true at all. I’ve created a CA and a script to generate and sign server certificates and I generated them left right and centre now for my very standalone, local network only with no access to the internet whatsoever services. I added my CA to my browsers and my iPhone and everything works perfectly.
- dimensi0nal 6y agoA .net is 83 cents a month.
- imtringued 6y agoThat's usually a limited special offer. Not everyone wants to change domains every year.
- dimensi0nal 6y agohttps://www.cloudflare.com/products/registrar/ https://www.cloudflare.com/products/registrar/
- jt2190 6y agoThere’s always the .local TLD, which is reserved for this use case: https://en.m.wikipedia.org/wiki/.local https://en.m.wikipedia.org/wiki/.local
- xg15 6y agoI haven't heard about that yet. this sounds interesting indeed. But how would I get a valid certificate for a .local domain?
- jt2190 6y agoYou need to set up your own “chain of trust” to verify your self-generated certificates. You can run your own Certificate Authority for example. (There are other approaches too.)
- lvh 6y agoThat works, but you can't get public certs for it, because you can't prove you own that domain (indeed, you don't :))
- jt2190 6y agoPlease remind me where I said anything about public certificates. ;-) xg15 is going to have to run a self-hosted Certificate Authority (CA) and generate certificates himself.
- Karunamon 6y agoThat article goes on to state that .local is reserved by RFC6762 (multicast DNS), which if you use that domain on your network, will cause problems with any services using it, usually Macs or iPhones. This document specifies that the DNS top-level domain ".local." is a special domain with special semantics, namely that any fully qualified name ending in ".local." is link-local, and names within this domain are meaningful only on the link where they originate. [...] Any DNS query for a name ending with ".local." MUST be sent to the mDNS IPv4 link-local multicast address 224.0.0.251 (or its IPv6 equivalent FF02::FB). I'd recommend using something like .lan instead.
- lawnchair_larry 6y agoThis is a ridiculous requirement that is not at all practical.
- gsich 6y agoYou can also run your own CA.
- geerlingguy 6y ago> This is a ridiculous requirement that is not at all practical.
- gsich 6y agoFor a company? Absolutely not. In private? Probably not worth the effort, just skip the cert warning.
- nitrogen 6y agoMost hardware in this category really needs to be set-and-forget, whether online or not. You can't have every random sound system and light controller having to dial out to a third party every month. You need to be able to come back five years later and still be able to configure the hardware.
- rad_gruchalski 6y agoReally. This: https://jamielinux.com/docs/openssl-certificate-authority/ https://jamielinux.com/docs/openssl-certificate-authority/ gives you a CA in about an hour. HashiCorp Vault will give you a CA in 5 minutes. certstrap will give you a CA in 15 seconds. It’s 2020, it ain’t voodoo anymore.
- Karunamon 6y agoJust spinning up a CA is a couple of commands. Running one sanely (to include security of the private keys, availability and auditability of the signing machine, keeping backups, publishing a CRL, setting up ACME if you want any kind of automation) is significantly more involved.
- xg15 6y agoThis won't work either, btw: You'd have to request from Let's Encrypt a new certificate for each individual device. LE has several rate limits that will prevent that from working for anything more than a trivial number of devices: https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ The only way I see how this would work is if you not just purchase a domain but also an internet-facing server and do the renewal and certificate management centrally for all devices - at which point, your device is definitly not standalone anymore.
- MikeHardman 6y agoYou can do wildcard certs with LE, I run hundreds of k8s services all secured with LE and wildcard certs.
- stefan_ 6y agoWe're talking about customer hardware. If someone looks at the insides of the device and finds, of course, the private key for your one shared wildcard certificate, the issuer is required to invalidate it immediately.
- lvh 6y agoYou can, but that wouldn't quite work for the prosumer router manufacturer case the OP mentioned: LE would revoke the cert once you distributed it.
- AdamJacobMuller 6y agoYou can, but, you can't (by policy) distribute keys across multiple customers.
- tgsovlerkhgsel 6y agoI have a nasty habit of requesting revocation of such compromised keys whenever I find them. CAs are required to revoke within 24 hours, I think, though unfortunately revocation is surprisingly ineffective.