SSL for hardware devices that can't run certbot. reddit / selfhosted ---------------------------------------------------------------------- eax0x0b · 2023-10-16 18:05 I realize that this topic has been beaten to death, but I've yet to come across a solution that will work for me. I'm familiar with Let's Encrypt, which obviously works super well for it's intended use, but what about for services where you can't run certbot? eg: iDRAC, routers, switches, etc.? I currently have a LE wildcard for my domain, which I use only locally (for now), but having to manually update the certs every 90 days for devices that can't run cerbot is a hard pass. Is my only solution to this scenario to set up my own CA and go about it that way? If so, is there anything out there that will help assist the management of certificates and deployment of root certificates to clients? I know that this can be done via GPO, but I don't have a Windows computer on my home network. I suppose another option would be to use a reverse proxy, but I would prefer to not have to go that route in this specific case if there are other options available. Anyway, interested in what others are doing to address this. ---------------------------------------------------------------------- ElevenNotes · 2023-10-16 18:12 I use this [container](https://hub.docker.com/r/11notes/certbot) to generate all certificates for all systems, even stuff that's not HTTPS but uses TLS. Either get a wildcard or use internal the same domain as external (split DNS) but logically no access to internal services (via LE DNS). ---------------------------------------------------------------------- gromhelmu · 2023-10-16 18:20 I wrote [https://github.com/Sieboldianus/ssl_get](https://github.com/S ieboldianus/ssl_get), which is a small script that helps distribute SSL-certs locally (e.g. from a central VM with Let's Encrypt, OPNsense, of pfsense etc.). Works flawlessly since 6 years for all my local services. ---------------------------------------------------------------------- throwaway43234235234 · 2023-10-16 18:20 Just use the certbot container to generate your wildcard certs as part of a script to copy/distribute them where they need whenever you need to renew. ---------------------------------------------------------------------- eax0x0b · 2023-10-16 18:27 I guess I'm confused by this.. because unless I were to run a reverse proxy for iDRAC, how would the created certificate be used on/uploaded to iDRAC? ---------------------------------------------------------------------- eax0x0b · 2023-10-16 18:29 but iDRAC (and many others), for example, as far as I know, only have a web interface that allows you to upload the certificates.. so that would still require manually uploading those certificates every 90 days. It's entirely possible that I'm missing something in this process. ---------------------------------------------------------------------- eax0x0b · 2023-10-16 18:35 I'm not sure that's going to work in this specific instance, but I can think of all sorts of other situations where this would be extremely useful.. definitely going to play with it. Thanks! ---------------------------------------------------------------------- ElevenNotes · 2023-10-16 18:37 You simply add the cert and key from the container to iDrac via racadm or API depending on your idrac version. You can also put iDrac behind a reverse proxy, whatever you prefer. ---------------------------------------------------------------------- eax0x0b · 2023-10-16 18:39 ah! I hadn't considered the possibility of using racadm to upload certs. Thank you! ---------------------------------------------------------------------- ElevenNotes · 2023-10-16 18:40 You're welcome. Just automate the process and forget about it. ---------------------------------------------------------------------- throwaway43234235234 · 2023-10-16 18:54 [https://www.dell.com/support/kbdoc/en-us/000120158/dell-poweredge- how-to-import-an-externally-created-custom-certificate-and-private- key-into-the-idrac](https://www.dell.com/support/kbdoc/en- us/000120158/dell-poweredge-how-to-import-an-externally-created- custom-certificate-and-private-key-into-the-idrac) Looks like you can use racadm at the command line to script tasks. ---------------------------------------------------------------------- eax0x0b · 2023-10-16 19:14 yeah, I just discovered that based on ElevenNote's response. Hadn't even considered racadm as an option, but that's certainly going to make this a lot easier.. lol thanks! ---------------------------------------------------------------------- phein4242 · 2023-10-16 20:02 I run an internal autosigning pki based on the cloudflare ssl toolkit and a bash script. ---------------------------------------------------------------------- ConfettiVirus · 2023-10-16 20:09 Okay, so it took me a second to parse exactly what your problem was: * you have devices (e.g., appliances) that don't run general-purpose operating systems which can't run a Let's Encrypt ACME client. * these LE clients would have installed the cert for you, thus automating that step; now instead you have to install the SSL/TLS certificate manually * Doing this every 90 days is tedious, and you are looking for something that will obviate this, and you'd rather not use a proxy for SSL offloading (e.g., NGINX). So firstly, whether or not you are using a wildcard LE cert or have your own CA is irrelevant. At the end of they day they will all give youn SSL cert that you ultimately have to install and you are faced with the same original problem. You have roughly three solutions for this: * firstly, rather than using Let's Encrypt as your CA, you can purchase a paid certificate from any number of vendors; they can give you an organizational validated (OV) or extended validated (EV) certificate with a one year lifetime as opposed to LE's 90 day domain validated (DV) ones; **this reduces the frequency of manually installing these to every 12 months instead of every 3 months, thus lessening the pain**; (NB: some vendors advertise 2, 3, 5 year certs, but AFAICT, they are giving out 1-year certs with some sort of "subscription" that gives you a new cert after every year without another validation step, this doesn't solve your problem) * secondly, you can figure out if there is some automated way to install the cert; [elsewhere in this thread](https://www.reddit.com/r/ selfhosted/comments/179cegc/ssl_for_hardware_devices_that_cant_run_cer tbot/k55i8kq/), someone mentioned that you can use the `racadm` CLI to script cert installation on iDRAC devices — an excellent suggestion; this obviously depends on the system you are dealing with, but you'd be surprised how many appliances have tools like this (either written by the vendor themselves, or by other people on GitHub, etc.), and is probably the best solution to the problem * lastly, if worse comes to worst, and your coding skills are up to par, you can write a quick script (python + [Requests](https://requests.readthedocs.io/en/latest/) would probably come in handy here) to automate this (cf. also [Selenium](https://www.selenium.dev/) for a low-code/no-code solution) ---------------------------------------------------------------------- lilolalu · 2023-10-16 20:23 For these things you do a proxy server with SSL offloading. ---------------------------------------------------------------------- eax0x0b · 2023-10-16 22:37 that's true with the http challenge, but not dns challenge.. I'm using the dns challenge (through cloudflare) to issue a wildcard ssl and now just distributing the certs/keys via racadm to the respective servers ---------------------------------------------------------------------- eax0x0b · 2023-10-16 22:45 that's essentially what I've done now.. I didn't even consider that it may be possible to update the certs on idrac via racadm.. as soon as I found that out I was in business. :-) also, re: own CA vs. LE - the main difference here is that while I could create a 10 year, or whatever, cert using openssl and get those to the servers easily enough.. the pain point is getting the root CA to all of the individual current and future clients that would be accessing everything, whereas with LE I wouldn't have to do this step... but instead update the servers/appliances every 90 days.. so I was just wondering if there were a service/app/something that made that process easier. kind of moot now, though, since racadm has done the trick. ---------------------------------------------------------------------- lilolalu · 2023-10-17 04:42 So why don't you use http challenge if it might solve your problem? ---------------------------------------------------------------------- michaelpaoli · 2023-10-17 06:07 >having to manually update the certs every 90 days for devices that can't run cerbot is a hard pass You automate the sh\*t out of it ... or at least as much as reasonably feasible. E.g. I've often done script/programs that will easily and automagically install certs across many servers/devices of lots of different types and configurations, with just a single command. If you can do it manually from CLI, you can automate it. I've also very well automated obtaining certs - again, simple quick command. Combine those things and some reasonable checks/monitors/reminders or whatever else, and you've got something that's fully automated to do it all ... or at least pretty darn close. ---------------------------------------------------------------------- revereddesecration · 2023-10-17 06:13 Why can’t you have your TLS managed at the gateway, then reverse proxy based on subdomain to your various services? ---------------------------------------------------------------------- ferrybig · 2023-10-17 11:37 The HTTP challenge has a bigger privacy impact compared to the DNS challenge. With the DNS challenge, you only get 1 certificate back, while the HTTP challenge requires you to submit every domain. If you look up the domain in a certificate log viewer, you can see all domains when the HTTP challenge is used, vs just the root with the DNS challenge For example, with stackoverflow, you see all their subdomains: https://crt.sh/?q=stackoverflow.com ---------------------------------------------------------------------- lilolalu · 2023-10-17 13:25 Ok, that's a point. But I don't understand the OP's problem in the first place: if his IPMI access is open to the internet: bad idea. If it's not open to the internet: why do you need SSL encryption in your local network? Or if you WANT SSL encryption locally because your oldest is a hacker: why don't you use a self signed cert? If you really really want a wildcared cert for privacy I'm your local network, why would you opt against a central proxy for your local services.... ---------------------------------------------------------------------- 12_nick_12 · 2023-10-17 13:34 Acme.sh can run a script after SSL cert updates. And it's nice since it's just bash. ---------------------------------------------------------------------- eax0x0b · 2023-10-17 15:02 the primary concern that I have with that model is that while traffic to the proxy is encrypted, \~everything behind the scenes is not (or, at least not in a trusted way). this isn't so much an issue when it's in front of a docker network, but it is when it's connecting to actual devices/servers on the physical network, as a compromise of a user account on one machine could allow for mitm and lateral movement/PE/domain takeover. ---------------------------------------------------------------------- eax0x0b · 2023-10-17 15:05 yeah, I had not really played much with racadm and so I didn't even consider the possibility of being able to update certs using it.. as soon as I made that discovery, my life has changed. lol ---------------------------------------------------------------------- eax0x0b · 2023-10-17 15:09 nothing on my network is open to the internet. I'm wanting SSL on the local domain between client devices and services on the physical network.. some of which (as far as I knew prior to discovering racadm) only had a web interface to upload certificates to, which would have forced me to do it manually every 90 days. I do not like the idea of a reverse proxy because it defeats the purpose. I mean, yes, it eliminates the SSL nag screen, but while the connection between the client and proxy are encrypted, the traffic between the proxy and the device are not - at least not in a trusted way, at which point it kind of seems pointless to even bother utilizing SSL. ---------------------------------------------------------------------- lilolalu · 2023-10-17 15:13 Sorry but you are talking about the physical INTERNAL network, right? so you want to encrypt the traffic from your laptop to your server closet, 10m away in CAT6? What's the attack vector on your internal network? Or are you talking about a business? How would an attacker snoop the data in your internal network? ---------------------------------------------------------------------- eax0x0b · 2023-10-17 15:20 and the primary reason why I wanted to avoid using my own CA is having to manage and provide the root cert to every current device on the network and every future device that may join the network.. ---------------------------------------------------------------------- eax0x0b · 2023-10-17 15:44 yes, internal network. I'm just following best practices.. the threat model is that a user account gets compromised, by one of a million different methods, allowing mitm and credential harvesting. no local user accounts have admin privileges across the network, and no services/servers share admin passwords. and yes, an attacker would need to be already on the network to sniff data, but just because they're "in" doesn't mean that it has to lead to a full compromise if you're following best practices. I also have my network segmented into \~10 vlans with firewalls between them to separate clients from data and isolate devices. I also use span ports to an IDS for local network traffic, too. being able to compromise a device/user/whatever and sniff unencrypted traffic because I'm using a reverse proxy rather than ensuring that traffic to the actual device is encrypted in a trusted way, I may as well not even bother with everything else that I'm doing. ---------------------------------------------------------------------- lilolalu · 2023-10-17 15:56 Ok, on your level of ... let's call it "thoroughness" ... I understand your question better. ---------------------------------------------------------------------- hereisjames · 2023-10-17 16:27 There is also [https://www.legocerthub.com/](https://www.legocerthub.com/) which was developed by a Redditor, you'll find the posts in r/selfhosted. He also has some example deployment scripts for non-servers which you could leverage too and can be adapted to other things (like getssl or [acme.sh](https://acme.sh)). One difference in his approach is that in most cases the remote target pulls the cert from your certificate server. Sometimes this is better or at least easier to monitor. ---------------------------------------------------------------------- farva_06 · 2023-10-17 18:38 I hate applying certs to IDRAC. I just put them in an isolated management network now, and just leave it be.