3 ms·

>> (e.g. anything where the servers are not connected to the Internet and do not even have every-few-days Internet access Actually it's possible to use the CA

>> (e.g. anything where the servers are not connected to the Internet and do not even have every-few-days Internet access Actually it's possible to use the CA system on a closed LAN. A) register a domain. For example company-lan.com. B) assign each server on your Lan with a name and (local) address. Eg, daisy.company-lan.com, resolving to say 192.168.1.1 Clearly this address is only useful when used inside your lan. C) provision certificates for this address using the DNS-Challenge approach rather than the HTTP-challenge approach. (Bonus tip; using a DNS provider with a good API makes the process automateable).

amluto 3y ago
This is why I said “do not even have every-few-days Internet access”. Without some kind of recurring connectivity, certificate renewals are impossible. (The client could, in theory, help, but that’s not a thing right now.) Systems like this are all over. Almost every IoT device is an example. More seriously, networking hardware is in this category. You can’t make connectivity to networking hardware depend on a working network with Internet access to obtain certificates without introducing a circular dependency and the possibility of making it very hard to recover from downtime. As a result, security of network control planes is often abysmal.
- bruce511 3y ago
  I'm not clear here if "Internet access" means incoming access, outgoing access, or neither. To be clear, the solution above requires no incoming access. Its 100% client, there's no server access. (Client to the DNS Api, client to ACME. If the device does not have client access to anything then the certificate can be obtained from another device. You would then need some mechanism to put the certificate on the device. I agree that IoT devices are problematic, they either need client access to the Internet (which most don't get) or they need to run a "server" of some kind to receive the certificate updates. If you're lucky this could be automated.
  - fires10 3y ago
    I have found it relatively easy to just run a local CA for my isolated network. I didn't find it too difficult to setup. I run around 600 servers and about 20x that in IOT devices.
    - marcthe12 3y ago
      Do you have a guide to do that?
    - amluto 3y ago
      And how did you provision any of this? Did you take each device, connect to it while on that same network in a completely unauthenticated manner, and provision certificates? Can you send links to webpages on these devices to ordinary browsers that aren’t provisioned with the certificates? Would someone who doesn’t fully trust you and your infrastructure be willing to install your certificate?
- AnthonyMouse 3y ago
  > You can’t make connectivity to networking hardware depend on a working network with Internet access to obtain certificates without introducing a circular dependency and the possibility of making it very hard to recover from downtime. Such things use ssh rather than TLS, or should.
Reitet00 3y ago
> C) provision certificates for this address using the DNS-Challenge approach rather than the HTTP-challenge approach. The other "bonus" is that due to CT it leaks the internal name to basically everyone on the internet. It may or may not be a problem but definitely something to be aware of.

amluto 3y ago

This is why I said “do not even have every-few-days Internet access”. Without some kind of recurring connectivity, certificate renewals are impossible. (The client could, in theory, help, but that’s not a thing right now.) Systems like this are all over. Almost every IoT device is an example. More seriously, networking hardware is in this category. You can’t make connectivity to networking hardware depend on a working network with Internet access to obtain certificates without introducing a circular dependency and the possibility of making it very hard to recover from downtime. As a result, security of network control planes is often abysmal.

bruce511 3y ago
I'm not clear here if "Internet access" means incoming access, outgoing access, or neither. To be clear, the solution above requires no incoming access. Its 100% client, there's no server access. (Client to the DNS Api, client to ACME. If the device does not have client access to anything then the certificate can be obtained from another device. You would then need some mechanism to put the certificate on the device. I agree that IoT devices are problematic, they either need client access to the Internet (which most don't get) or they need to run a "server" of some kind to receive the certificate updates. If you're lucky this could be automated.
- fires10 3y ago
  I have found it relatively easy to just run a local CA for my isolated network. I didn't find it too difficult to setup. I run around 600 servers and about 20x that in IOT devices.
  - marcthe12 3y ago
    Do you have a guide to do that?
  - amluto 3y ago
    And how did you provision any of this? Did you take each device, connect to it while on that same network in a completely unauthenticated manner, and provision certificates? Can you send links to webpages on these devices to ordinary browsers that aren’t provisioned with the certificates? Would someone who doesn’t fully trust you and your infrastructure be willing to install your certificate?
AnthonyMouse 3y ago
> You can’t make connectivity to networking hardware depend on a working network with Internet access to obtain certificates without introducing a circular dependency and the possibility of making it very hard to recover from downtime. Such things use ssh rather than TLS, or should.

Reitet00 3y ago

> C) provision certificates for this address using the DNS-Challenge approach rather than the HTTP-challenge approach. The other "bonus" is that due to CT it leaks the internal name to basically everyone on the internet. It may or may not be a problem but definitely something to be aware of.