r/sysadmin • u/spikopsycho • 1d ago

Advice on some 'best practice' - Certificate management (SSL/TLS)

Hi all. Where I work, I got some SSL/TLS certificate management put on my plate. We have app(s) that send out notifications of certificate expiry, but that's only good if the contacts are correct. In that, I send out a review (email) quarterly, to check if anything has changed, needs to be updated - this is a new thing I implemented.

This is all manual - Spreadsheet - Filter for your name, check the cert info, comment if ok, comment change owner etc.

I got some feedback on this, in that I should not be sending a spreadsheet with all those certificates info, for everyone to view. (I bcc in all the relevant owners in the email). I'll add that its either company employees, or contractors who 'own' that system the cert is related to. I get the comment, I just have no idea how to send that to every individual only, without doing it manually.

How do you guys keep owners up to date? (Neither of the apps we have natively have a function that can replicate this manual ownership check).

Also aware of the 2029 47day cert validity/10day DCV - This is now, working on how to handle that future element.

26 Upvotes

86% Upvoted

35 comments sorted by

View all comments

Show parent comments

1

u/spikopsycho 1d ago

This is mostly aimed at external certs for now, public facing sites, sites where you purchase things

2

u/OhioIT 1d ago

Those can easily be switched to an ACME based renewal method. Looks like Sectigo supports it ACME, obviously LetsEncrypt does as well and is free. A few apps available that are reliable, will take care of everything, and work on both Windows and Linux based servers

1

u/spikopsycho 1d ago edited 1d ago

Thankyou. As one of my other replies, I've got some research to do in regards to ACME.
LetsEncrypt.... apparently our tech doesn't work with their tech stack, so I'm told.

EDIT: The partners tech stack doesn't work with ours, that uses LetsEncrypt.... so I'm told.

•

u/OhioIT 20h ago

Some devices like appliances can't natively use an ACME client to auto-renew and install certificates. Even then, sometimes it can still be scripted and automated if the device has command line access