Hacker News Reader

Comment by rb808 | Hacker News Reader

Has anyone got a good way of managing certificates in the wild? With no real management and staff turnover I've seen a bunch of expired certificate problems.

EDIT: presumably you need your client apps/libraries in the field write back when they use a cert that is <X months away from expiry.

View on HN

I'd say someone very high up and "tied to the company", probably the CTO, should make sure a signing certificate is renewed when needed and make sure it's rotated every time it's about to hit expiration. For a company as big as oculus with the backing of Facebook, this is a pretty big issue.

I’d expect at Facebook’s scale, they’d have a PKI management team, and this would’ve gone through their certificate lifecycle management process.

I think the CTOs role here would probably be to make sure a process or team is in place to do this but not actually do it themselves? (For a company the size of oculus)

Define "managing"?

I use simple Nagios checks for keeping an eye on certificate expiration. It's simple to set up checks for new hosts/services and I have them set to trigger an e-mail alert 30 days before expiration (20 days for certificates from Let's Encrypt). It does the job; I have yet to wake up one day to an expired certificate.

Apparently, this ("send me an e-mail before my certificate expires") is also the sole reason some companies even exist (i.e., it is their only product/service). It amazes me that this is something folks will pay for.

What happens when you leave for a different job or get hit by a bus? More than one cert has expired because the guy who was maintaining them moved on and nobody else knew how to keep them up to date.

Obviously it should be part of a handoff process when you leave, but companies aren't always good at smoothly handling transitions like this.

I've been hit by a bus! Well, a Jeep Cherokee, technically, but I was on a motorcycle so it felt like a bus. I was off work for ~4 months -- couldn't even walk for the first three and could barely feed myself. We managed, though. We got by and didn't have any SHTF moments in my absence.

What happens if I leave, though? I don't know and, TBH, I won't really care; it won't be my problem at that point. How -- if -- things are handed off or transferred off to someone else when I leave will be up to my boss, I suppose.

I think 30 days might not be enough - maybe its best to create a new certificate every build or every month.

You can use secret management systems like Azure Key Vault to auto-roll/renew secrets, but your applications have to be built to use such systems.

(disclaimer: work for Azure, but not on Key Vault)

Feudal security at its best.

Never trust somebody else to make sure your certificate is renewed.

Case in point: Even Azure had a huge outage due to cert issues (abeit quite a bit more complicated than a simple expiration, but my point here is that certificates are hard.)

Reply on news.ycombinator.com