2

My org deploys a data server and a client device (two devices) in customers' internal networks for them to use our solution; the client device only connects to the data server; however any one customer site may not necessarily provide a static IP or a hostname, nor guarantee the persistence of the devices' IPs. The only things we know for sure we can control are our server and the client device; customers' requirements dictate the network setup.

The client device needs to connect securely to the data server over HTTPS, and we want to provide the option of installing our own certificate using our own CA on the data server. (of the customer can also install their own certificate, but that's beyond the scope of this question)

Since the data server's IP is not guaranteed persistence, I am left wondering, is it possible to issue a certificate to a service, rather than issuing the certificate for the address/name?

I've looked for "ssl certificates for services" and "for variable IPs" and suchlike, but found nothing relevant. Am I missing some terminology to help narrow down my search, or is this just not a thing at all?

Thanks

  • As a shim, we could configure the device's hosts file to point some.name to the data server's IP the user supplies to the device, and connect to some.name - so issue the cert for some.name, but a more proper solution would be preferable... – taifwa Jan 30 at 11:28
3

Ship a self signed certificate and provide a possibility for the customer to upload their own certificate.

That's how everybody does it, because it's the only option that really works. An administrator who sets up a service expects this, and has the option to install a valid certificate for his users.


After reading the question again and thinking about it, I think there actually is an option:

for the user interface:

  • ship with self signed certificate
  • provide option to upload a certificate for admins

for the inter-device communication:

  • create your own CA (in your own internal network, this CA does not leave your company)
  • configure the client devices you ship to your customers to trust this CA
  • create a Sub-CA of your CA on your server device
  • after installation of the server at the customer site have the server device create a certificate for itself by the sub-ca
    • at this point you have the IP address and can resolve the IP address to an valid internal DNS name
  • (optional: after installation of the client at the customer site have the client device request a certificate from the sub-ca on the server.
    This isn't really necessary, but it could be used to have the server authenticate the client, if you only want your own clients to be able to communicate with the server)

This way your clients trust your own server, and you can even extend it to a two-way trust between your devices alone.

  • That actually sounds like a variation on what we were already envisaging.... using a further Sub CA on the server to dynamically generate its own cert sounds like an interesting idea, I'll keep it in mind... – taifwa Feb 4 at 10:09
4

You need to issue a certificate for a DNS name, not for an IP address. If your internal server listens to service.example.com then the certificate needs to match this "common name". Should the server get a new IP address every time it boots, you just need to make sure that the DHCP server updates the DNS server with the new information so that the A record for service.example.com always point to the correct IP address. For this you will need to work together with each customer where you want to deploy your application as every company might differ in how they implement this.

It will be better of course to "demand" a fixed IP address or an DHCP reservation so the DHCP server will always give your server the same IP address based on the MAC address of your server.

Should you want to set up your own CA server in the network of your customer, you will again need to work together with the customer closely as they will need to put your root certificate on each and every client computer in the company so that your CA's certificates will be trusted. Otherwise the browser will issue a big fat warning message that the (root) CA is not trusted.

0

Look up the term Dynamic DNS. I always use it for sites where I can't guarantee a static IP.

Namecheap and several other DNS registrars provide this service at no additional cost if you want it for your own domain(s), but there are separate entities that provide the service for a small fee by assigning you a subdomain to their own domain name.

  • Sorry, by "customer site" I meant "internal network". I use Dynamic DNS too for public things ; this is not such a scenario... – taifwa Jan 31 at 12:42
  • Do the machines have known names? Windows does (with a slight bit of cajoling) dynamic DNS registration for DHCP clients in an internal network too, so as long as you know a machine’s FQDN you can always use certificates for that FQDN, or create a wildcard certificate valid for all servers in a domain. – Mikael H Jan 31 at 13:21
  • Alas, that makes too many assumptions - as detailed, I'm trying to put together something that can work in all scenarios - from DHCP/NetBIOS names not propagating, to locked-down environments. At the general-case level, the only things we know we control are our own servers and devices. – taifwa Feb 4 at 10:13

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.