Certificate automation: Recommendations?

Question asked by Douglas Foster - Today at 7:08 AM

Unanswered

I am looking for recommendations for a certificate automation platform, including:

The ability to obtain certificates from an internal CA and a public CA.
The ability to do DNS authentication.
Robust tools for automated deployment and activation of new certificates.
Dashboard for configuring the automation process and monitoring status.

Any and all suggestions are appreciated.

For those who may be even farther behind in this process than myself, what follows is my attempt to summarize everything that I understand about certificate automation.

How automation works using HTTP verification on public-facing websites:

A certificate automation client sits on a managed machine, and starts the renewal process.
It submits the request to a certificate authority, specifying HTTP validation.
The certificate authority provides a verification secret.
The local agent places the verification secret on a specific HTTP path
The certificate authority queries the website for the secret.
After verification, the certificate authority makes the certificate available.
The local agent retrieves the certificate, installs it, and activates it.
The website must be publicly accessible on port 80, although it can redirect to HTTPS on 443.

Obstacles:

Most public-facing web servers are HTTPS only. Enabling HTTP, even for this purpose, is an unattractive change to security.
Some servers need a public certificate, but do not have a public facing website. An incoming email gateway is one example, because it needs a certificate for public-facing SMTP. It may have an admin website, but the website is not public facing.
Some servers need a certificate, but are internal only and do not need a public certificate. These servers cannot use HTTP validation at all.

Given these issues, a general solution requires DNS validation. Once DNS validation is available for some purposes, it might as well be used for all of them.

How automation works using DNS verification:

A local software agent sits on a managed machine, and starts the renewal process.
It forwards the request to a centralized certificate automation broker somewhere on the network.
The centralized agent submits the certificate request to the certificate authority, specifying DNS validation.
The certificate authority provides a verification secret.
The centralized agent connects to the organization's DNS server using an API to publish the secret.
The certificate authority finds the secret in DNS and makes the certificate available.
The centralized agent downloads the certificate and works with the local agent to get it installed and activated.

Implementation Concerns

DNS automation requires a public DNS provider that permits changes using an API. That may require migration to a different DNS platform.
Automation appears to be incompatible with wildcard certificates, even when using DNS validation. This increases the number of certificates being managed, but also improves security. If certificates are issued by a fee-charging public CA, organization costs will climb. One must either use LetsEncrypt for everything, or use an internal automation server for an internal CA, plus a public CA for public certificates.
A certificate management dashboard application becomes necessary to track each machine being managed, how automation is configured for each one, and whether that automation process is healthy.
Servers tend to have many different ways of installing and activating certificates. A robust set of tools will be needed to facilitate this process. Development and testing will be needed to tailor those tools to meet the particular requirements of each certificate-using application.
The dashboard application also acts as a proxy for each of the managed machines:
- It collects certificate requests from client software.
- Determines the certificate authority to use, and forwards the request.
- Handles DNS validation for the request.
- Retrieves the approved certificate.
- Triggers a script to install and activate the certificate
- Provides visibility to determine if all of the above is working properly.
- Provides event notification when problems occur.

Deployment Process

Purge any unnecessary host names to reduce complexity.
Develop a list of certificates needed, including where multiple SANs needed, and where the certificates will need to be installed.
Acquire a certificate dashboard and server-side certificate automation agent.
Connect the certificate dashboard to the internal DNS.
Begin deploying automated certificates to internal sites.
Migrate public DNS to one with an API and connect the dashboard to it.
Connect the certificate dashboard to the public DNS
Connect the certificate dashboard to LetsEncrypt and any other CAs.
Develop deployment scripts for each target environment.

Back to Community Threads

Reply to Thread

Enter the verification text