4

My IoT company would like to use client certificate authentication to secure communications between each "thing" and a central server. We deploy about 30K things per year, and they have about a 5-year lifetime, so our server-side solution needs to be able to support 150-200k certificates at a time. From reading and asking other questions, it seems like the best-of-breed solution is EJBCA, which appears to scale quite well, but I also see that haproxy (theoretically) has the ability to do it as well.

My question is this: how well does haproxy scale to handle a large number of client certs and connections?

1
  • Welcome on Security SE. Your question being not strictly security related, I think it could be more suited on Server Fault. Dec 29, 2015 at 10:48

1 Answer 1

1

Issuing 30K certificates a year is very low, less than an average of 5 every hour. Any CA will support this.

If you are worried about work load you need to consider your revocation strategy. Questions you need to answer include:

1) Are you going to support certificate revocation?

2) Are the clients going to check it or only the servers?

3) Are you going to issue CRLs or use an OCSP?

4) If you use CRLs, how large will them be (how many certificates are you going to revoke per year)?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .