3 ms·

There is SCEP (https://en.m.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol https://en.m.wikipedia.org/wiki/Simple_Certificate_Enrollmen...) which all

There is SCEP (https://en.m.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol https://en.m.wikipedia.org/wiki/Simple_Certificate_Enrollmen...) which allows that and is often found on network devices. You need a PKI which exposes a SCEP endpoint (ejbca or dogtag supports this). That the certificate is used as certificate for the HTTPS is up to the device implementation of the scep client or something else in the client though. On servers, certmonger can do scep iirc. On private infrastructure, FreeIPA provides a packaged dogtag and you can create your own certificate profiles. Clients enrolled in freeipa have certmonger installed to refresh certificates.

mananaysiempre 3y ago
> You need a PKI which exposes a SCEP endpoint (ejbca or dogtag supports this). Uhh... > [...] ejbca [...] Now you have two problems. What I mean is, if you’ve been already running EJBCA for whatever reason then this is perhaps reasonable, but if your current setup is at the level of typing `openssl req` into a terminal (whether that’s a good idea or not), it sounds like a lot of additional complexity. (Can’t say anything about dogtag.) I’ve been waiting forever for somebody to add an ACME backend to the Go SCEP library[1], but it doesn’t look like that has happened. In the meantime it includes a fairly competent standalone CA server at the abovementioned invoke-openssl-by-hand level. Note that SCEP basically requires a trusted network, though, from what I remember. [1] https://github.com/micromdm/scep https://github.com/micromdm/scep