4 ms·
Because of all my internal systems that use certs to connect (switches, routers, iot, etc) that have manual only interfaces (most are tftp), I have had to go ba
by FuriouslyAdrift 1y ago
Because of all my internal systems that use certs to connect (switches, routers, iot, etc) that have manual only interfaces (most are tftp), I have had to go back to just running my own CA infrastructure and only using public CAs for non-corporate or mixed audience sites/services.
It's really annoying because I have to carve outs for browsers and other software that refuse to connect to things with unverifiable certs and adding my CA to some software or devices is a either a pain or impossible.
It's created a hodge podge of systems and policies and made our security posture full of holes. Back when we just did a fully delegated digicert wildcard (big expense) on a 3 or 5 year expiration, it was easy to manage. Now, I've got execs in other depts asking about crazy long expirations because of the hassle.
- 9dev 1y agoWhy is fronting these systems with a central haproxy with TLS termination or similar not an option?
- whatevaa 1y agoFronting a switch management interface with haproxy? Are you sure that is a good idea?
- 9dev 1y agoYes. If we're talking about handling TLS termination and putting an IP behind a sensible hostname, I don't see what's wrong about using a reverse proxy. Note that this does not imply making it accessible on the internet.
- FuriouslyAdrift 1y agoYet more infra that must now be managed and a point of failure. No thank you.
- 9dev 1y agoWell. That, or maintaining bespoke PKI and internal CA, along with manually renewing certificates with ever-shortened expiration periods as demanded by browsers. Pick your poison.
- FuriouslyAdrift 1y agoWindows infra so certificate services is already baked in for 802.1x, etc.
- dvdkon 1y agoBecause then you have plain HTTP running over your network. The issue here (I presume) is not how to secure access over the Internet, but within an internal network. Plenty of people leave these devices without encrypted connections, because they are in a "secure network", but you should never rely on such a thing.
- 9dev 1y agoNothing stops you from using a self-signed certificate with a ridiculous expiration period for HTTPS between the reverse proxy and the device in question.
- FuriouslyAdrift 1y agoExcept browsers and other software that are becoming hard-coded to block access to such devices. We used to use Firefox solely for internal problem devices with IP and subnet exclusions but even that is becoming difficult.
- fanf2 1y agoUse the self-signed cert between the proxy and the problem device; everything else talks to the proxy.
- cpach 1y agoOr Wireguard.
- FuriouslyAdrift 1y agoUsing VPNs on server infrastructure to punch a hole is a resume generating event.
- 9dev 1y agoWireguard is not a VPN, it’s a protocol that can be used for a lot of things.