4 ms·

I've literally never seen anybody use a domain name to address my devices, only a simple IPv4. That already makes it a nonstarter, but let's entertain the idea.

by simias 6y ago

I've literally never seen anybody use a domain name to address my devices, only a simple IPv4. That already makes it a nonstarter, but let's entertain the idea. Maybe I can convince my clients to change the way they work, they generally love that. Just going through the trouble of having the customer mess with their OS's DNS resolver to connect to the device is ludicrous. Can you even do it on Windows without having to deal with the hosts file manually? Then they need to remember to update it when the IP inevitably changes because they've moved onto a new project with a different address plan, and they'll invariably forget to change it or forget how to do it or do it wrong and then call me to help them. And on top of all that, no I can't really expect my devices to have internet access, not even once every 60 days. It's not uncommon for broadcast operations to use costly and critical satellite links for internet access, and they're not going to let random devices use that without a good reason. More generally, even if there's an internet connection available they're likely not to configure the gateway correctly, then complain when the night of the big event their browser refuses to connect to my equipment, saying that they're about to be h4x0r3d. My use case is certainly a niche, but I think it's probably a significant niche given that everything and anything has web interfaces these days. Cameras have web interfaces for configuration, middle end smart switches and routers have web interfaces, I've even seen power plugs with web interfaces...

Spivak 6y ago
I don't think Let's Encrypt is going to be the right use-case for you then. I think your best bet is to work with another CA to get your company an intermediate cert that you can use to issue longer certs that include ip addresses in the SAN. Then it's just a matter of the devices connecting to the internet at least once a year and doing a very simple "Hey, I'm $device and using $address. Issue me a cert plz."
- xg15 6y ago
  > work with another CA to get your company an intermediate cert I'm no expert, but wouldn't that make GP's company effectively a delegate CA? This seems like it would need a very close relationship with the original CA - and all just for a simple web interface. > include ip addresses in the SAN. Not sure if this may be different with intermediate certs, but you won't find any public CA that will add private IP addresses as a SAN - as this would undermine the whole security model. If any CA did this, Chrome would likely ban them quickly. I'm sceptical a CA would let you do that with intermediate certs if there is any danger the leaf certs get into the wrong hands (e.g. because the devices are sold, someone reverse-engeneers one and manages to talk to the back-end service)
rswail 6y ago
There are a couple of possibilities here, given that we're talking costly and critical satellite links. 1. You set up a private PKI using a private CA. AWS will sell you one for $400/month. Install the public root in the trust stores of the clients and then issue 5 year private certs for either IP addresses, or for .local and use DNS-SD. 2. You create a private domain at private.example.com. You get letsencrypt to issue a wildcard for .private.example.com. Then you set up private DNS for that zone. Server cert needs to be updated every 90 days. That involves downloading a single PEM file from your internal network.

by simias 6y ago

Spivak 6y ago

I don't think Let's Encrypt is going to be the right use-case for you then. I think your best bet is to work with another CA to get your company an intermediate cert that you can use to issue longer certs that include ip addresses in the SAN. Then it's just a matter of the devices connecting to the internet at least once a year and doing a very simple "Hey, I'm $device and using $address. Issue me a cert plz."

xg15 6y ago
> work with another CA to get your company an intermediate cert I'm no expert, but wouldn't that make GP's company effectively a delegate CA? This seems like it would need a very close relationship with the original CA - and all just for a simple web interface. > include ip addresses in the SAN. Not sure if this may be different with intermediate certs, but you won't find any public CA that will add private IP addresses as a SAN - as this would undermine the whole security model. If any CA did this, Chrome would likely ban them quickly. I'm sceptical a CA would let you do that with intermediate certs if there is any danger the leaf certs get into the wrong hands (e.g. because the devices are sold, someone reverse-engeneers one and manages to talk to the back-end service)

rswail 6y ago

There are a couple of possibilities here, given that we're talking costly and critical satellite links. 1. You set up a private PKI using a private CA. AWS will sell you one for $400/month. Install the public root in the trust stores of the clients and then issue 5 year private certs for either IP addresses, or for .local and use DNS-SD. 2. You create a private domain at private.example.com. You get letsencrypt to issue a wildcard for .private.example.com. Then you set up private DNS for that zone. Server cert needs to be updated every 90 days. That involves downloading a single PEM file from your internal network.