this post was submitted on 16 Oct 2023
4 points (100.0% liked)

Self-Hosted Main

515 readers
1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

For Example

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

founded 1 year ago
MODERATORS
communick@selfhosted.forum
4
SSL for hardware devices that can't run certbot. (alien.top)
submitted 1 year ago by eax0x0b@alien.top to c/main@selfhosted.forum
7 comments fedilink hide all child comments
 

I realize that this topic has been beaten to death, but I've yet to come across a solution that will work for me.

I'm familiar with Let's Encrypt, which obviously works super well for it's intended use, but what about for services where you can't run certbot? eg: iDRAC, routers, switches, etc.?

I currently have a LE wildcard for my domain, which I use only locally (for now), but having to manually update the certs every 90 days for devices that can't run cerbot is a hard pass.

Is my only solution to this scenario to set up my own CA and go about it that way? If so, is there anything out there that will help assist the management of certificates and deployment of root certificates to clients? I know that this can be done via GPO, but I don't have a Windows computer on my home network.

I suppose another option would be to use a reverse proxy, but I would prefer to not have to go that route in this specific case if there are other options available.

Anyway, interested in what others are doing to address this.

top 7 comments
sorted by: hot top controversial new old
[–] boblin@infosec.pub 3 points 1 year ago

Can you have the cert be generated on a server and then sync it to your hardware with scripts or ansible?

[–] Godort@lemm.ee 1 points 1 year ago

I would also like an answer to this.

My solution so far has been to just purchase full 1y certs and then it's a problem that I only need to look at once a year

[–] revereddesecration@alien.top 1 points 1 year ago (1 children)

Why can’t you have your TLS managed at the gateway, then reverse proxy based on subdomain to your various services?

[–] eax0x0b@alien.top 1 points 1 year ago

the primary concern that I have with that model is that while traffic to the proxy is encrypted, ~everything behind the scenes is not (or, at least not in a trusted way).

this isn't so much an issue when it's in front of a docker network, but it is when it's connecting to actual devices/servers on the physical network, as a compromise of a user account on one machine could allow for mitm and lateral movement/PE/domain takeover.

[–] michaelpaoli@alien.top 1 points 1 year ago (1 children)

having to manually update the certs every 90 days for devices that can't run cerbot is a hard pass

You automate the sh*t out of it ... or at least as much as reasonably feasible.

E.g. I've often done script/programs that will easily and automagically install certs across many servers/devices of lots of different types and configurations, with just a single command. If you can do it manually from CLI, you can automate it.

I've also very well automated obtaining certs - again, simple quick command.

Combine those things and some reasonable checks/monitors/reminders or whatever else, and you've got something that's fully automated to do it all ... or at least pretty darn close.

[–] eax0x0b@alien.top 1 points 1 year ago

yeah, I had not really played much with racadm and so I didn't even consider the possibility of being able to update certs using it.. as soon as I made that discovery, my life has changed. lol

[–] 12_nick_12@alien.top 1 points 1 year ago

Acme.sh can run a script after SSL cert updates. And it's nice since it's just bash.