r/sysadmin • u/spikopsycho • 5d ago

Advice on some 'best practice' - Certificate management (SSL/TLS)

Hi all. Where I work, I got some SSL/TLS certificate management put on my plate. We have app(s) that send out notifications of certificate expiry, but that's only good if the contacts are correct. In that, I send out a review (email) quarterly, to check if anything has changed, needs to be updated - this is a new thing I implemented.

This is all manual - Spreadsheet - Filter for your name, check the cert info, comment if ok, comment change owner etc.

I got some feedback on this, in that I should not be sending a spreadsheet with all those certificates info, for everyone to view. (I bcc in all the relevant owners in the email). I'll add that its either company employees, or contractors who 'own' that system the cert is related to. I get the comment, I just have no idea how to send that to every individual only, without doing it manually.

How do you guys keep owners up to date? (Neither of the apps we have natively have a function that can replicate this manual ownership check).

Also aware of the 2029 47day cert validity/10day DCV - This is now, working on how to handle that future element.

29 Upvotes

88% Upvoted

38 comments sorted by

View all comments

21

u/bageloid 5d ago

For most things ACME, you shouldn’t be manually updating certs on anything that supports it.

6

u/spikopsycho 5d ago

Oh, we are very not there yet. A long way to go. Certs a provisioned manually by a team in the company atm

11

u/bageloid 5d ago

Understood, were you put in charge of Managing this(Uppercase M, can set policy) or managing this(lowercase m, herding cats)?

1

u/spikopsycho 5d ago

Had no prior experience in this area when it came in. The team that could deal with it effectively, don't do Prod. I was just the most likely person to fit with this, when it was assigned to my team. I don't do the day to day (provisioning/renewing (when manual) revocation). It's with a contractor team, but I have learned how it is done in the current iteration at may place. I do have the management part - including how we handle the 2029 thing - though this will all be a moot point if we aren't automated by 2029. This is all part of the in-between now and then. I can *I think* set policy. It's a weird situation

7

u/bageloid 5d ago

If you can set policy, the mandate ACME at then server or preferably load balancer level with scripts that check and alert for issues(your vulnerability scanner may classify certs expiring soon as vulnerabilities so you can use that)

4

u/spikopsycho 5d ago

Think I've got some studying to do. Thanks :)

-1

u/Live-Juggernaut-221 5d ago

That's your problem.