distributed SSL certificates?

[ZippyDan]

I'm only familiar with SSL certificates in a simple-use case: I've installed them to websites, windows servers, and a few linux servers.

I'm now faced with the task of securing every possible device in our international network with SSL certificates. I've purchased a wildcard *.mydomain.com certificate from Comodo so that I can use the same certificate everywhere, but I'm still faced with the mountainous task of installing certificates to many Windows servers, apache servers, Linux servers of various flavors, proprietary OS's, desktops, and even printers.

What is most daunting about this task is that I will need to do it again and again - every time the SSL certificate expires. I know I can purchase a 5-year certificate, but even still, it is a hassle I'd rather not have to repeat.

Is it possible to have one system (like a Windows domain server) act as a certificate server and then just load every other device with a certificate that "points" to the certificate server for validation? My idea is that I would only have to update the certificate in one central location, and then all the other devices pointed to that server would automatically be current. I've already noted that there are concepts like "Intermediate CAs" and "Local CA Authorities", but I'm not sure if it is possible to leverage those concepts into helping me distribute a certificate from a big-name CA down the network...

 

[matricks]

I started writing something (left it below), but came to the realization that there is something more important to be said: what do you (your company) hope to achieve by installing certificates on every device you own? It's not a strange thing to do, it's just that your post shows a desire for convenience, and little concern for actual security. Establishing a public key infrastructure is one of the things where you really need to get it right. A poorly planned/managed PKI will probably cause a lot more issues than no PKI at all.

---

What is the use case? Is it the company-owned devices/services that need to trust each other, or do you need the Internet as a whole to trust your desktops, servers and printers?

If it's internal, you could establish your own root certificate authority. Anyone can be a CA, the difference between me and Thawte, Comodo and Verisign is that they are trusted CAs, having more or less universal global trust. I trust myself, and in cases where that is all I need, I don't need to pay the CA industry to trust me. At work we are our own root CA. Internal services, test environments and so on use certificates that are signed by the internal CA. Public facing stuff uses certificates signed by globally trusted CAs.

When you are a root CA, you install your root certificate (not the key!) on every device that needs to trust your certificates. You then issue certificates as needed, and all devices with the root certificate installed will trust any certificate issued by the root CA. The thing about this is that as the CA, you decide what policies the CA apply. You can't issue certificates that will never expire (because X.509 standard requires an expiration date), but you can issue certificates that expire in hundreds of years, if that is an acceptable policy for your company. You make all the decisions, and can apply strict or lax policies as it fits your security requirements.

I don't know of a system to "redirect" certificate requests, as you suggest, where certificates can be renewed at a single point. It sounds like something that would defeat the purpose of certificates in the first place. Say I set up a rouge server pretending to be one of yours, how would the certificate master service tell my rouge server from legitimate servers? I think you have to look into automated deployment of keys and certificates, that would seem far more likely to exist (or easy to script, compared to inventing something like you suggest).

If certificates from trusted CAs makes more sense in your use case, differentiate them. The private keys that would authenticate a public facing website should not exist on a random desktop or printer. If you install your wildcard certificate key on all of these devices, and an attacker steals the key, he can impersonate any device or service under your domain.

 

[John Connor]

I was thrilled to hear about this. https://letsencrypt.org/ but from the looks of it I can't download a Cert, I have to use bloody Linux commands in the server. Well that doesn't work for me since I'm on a shared host and need the ability to upload the Cert into cPanel.

 

[matricks]

Let's Encrypt is completely unrelated to OPs problem, but here is a tool that will help you: https://github.com/diafygi/letsencrypt-nosudo

The procedure can be adapted to a shared host with only control panel access. Make a thread about it if you need help.

 

[debian0001]

You can setup PKI and possibly make the certs as long as you want but it would only truly work if you loaded the intermediate cert to each device... it's easy with Windows because you can do it via Group Policy.