Luckily, there is a solution: The "ACME" protocol popularized by the Let's Encrypt initiative makes it relatively painless to renew certificates. Sadly, not all software supports it, and in particular, IoT devices often do not support it [5]. Why Run Your Own Certificate AuthorityLet's step back for a moment, and look at the certificate authorities. Why do you want to run your own? There are a couple of reasons that made me use my own certificate authority:
How to Get Started With Your Private Certificate AuthorityI found the easiest way to set up your own certificate authority (and be able to use the ACME protocol) is smallstep [7]. Smallstep is often used for SSH keys, but it is also a very capable certificate authority and easily runs in a virtual machine or container. When I started to use smallstep, it required a bit of work (a patch) to be compatible with macOS. But I believe this issue has been fixed yet. Certificates obtained via ACME were missing the "CommonName" that MacOS (and the RFC) require. Today, the "Getting Started Guide" is all you should need. The setup process will do all the hard work for you. You will get a CA certificate, and Intermediate certificate and should be ready to go in no time. Just make sure to import the CA certificate into your clients and trust them. (I include the intermediate certificate as well to avoid some issues with the intermediate certificate not being included by a server). The certificate authority doesn't necessarily have to be online all the time, but for ACME to work best and for your systems to be able to automatically renew certificates, you may just want to keep it running. Using Your Own Certificate Authority with "certbot""certbot" is the most popular ACME client these days. All you need to do to use it with smallstep is to point it at your own smallstep server:
by default, smallstep listens on port 8443. The system you run certbot on needs to trust the smallstep CA or the connection will fail. For internal verification, I also like DNS instead of the normal default HTTP. You often deal with devices that have odd web server configurations. So you can not easily spin up a stand-alone web server, or use the nginx/apache plugins. The home directory is also not always writeable (or even present). So DNS makes for a nice alternative. To use DNS, it is easiest if you run an internal authoritative DNS server for the respective zone, and enable dynamic updates. Certbot has a "dns-rfc2136" module that supports authenticated dynamic DNS updates. [9] A Lot of Moving Parts...So here is a quick "To Do" list of everything you need in the rough order you should set it up:
Enjoy!
--- |
Johannes 4479 Posts ISC Handler Apr 15th 2021 |
Thread locked Subscribe |
Apr 15th 2021 1 year ago |
Thanks!
I already came across Smallstep and its ACME CA implementation and it is great. I am also running RFC2136 on dedicated external records (manually setup intially), but for some reason I didn't figure if I have my own internal subdomain from an external domain many things would be so much easier. Thanks for that! I will look into this in due course! Keep up the good work! |
Thomas 4 Posts |
Quote |
Apr 16th 2021 1 year ago |
"Currently, browsers will reject certificates valid for more than 13 months (398 days)"
This is not strictly true for (most) internal CAs. Apple only enforces this for certs issued by "factory-trusted" CAs on their products. Chrome (and by extension most other browsers) only enforce this for certs issued by CAs that are publicly-rooted (read: trusted by the browser by default) - of which there are very few. So it should still be viable to issue and successfully use that 10-year internal cert. |
Anonymous |
Quote |
Apr 16th 2021 1 year ago |
Sign Up for Free or Log In to start participating in the conversation!