Skip to main content
Information Security

Return to Answer

added 668 characters in body
Source Link
Steffen Ullrich
Steffen Ullrich
  • 207.5k
  • 30
  • 416
  • 481

Yes,Large edits because now it is clear that OP is asking about devices which only work as a TLS client...

If this is only for client devices than you don't need to have some secure way to update the certificate for thison the device. One reason since there is no certificate on the 39 month limit, anotherdevice. The certificate is a possible compromise of the public key used foron the certificateserver (how it is protected anyway for such a long time?).

And given all the recent bugs in TLS libraries you better have a secure firmware update too. Apart from that you either need your cryptography ready until the end of the 10+ years time frame orwhich you need to have ways to upgrade the algorithms and protocols in use. Note that within this long time frame TLS 1.0update) and TLS 1.1 will probably get deprecated, as do 2048 bit RSA keys. It might also be thatis checked against the not yet released TLS 1.3 will be already required.

Will it only be the servers's certificate I need to replace and not the root CA on the device?

The Rootroot-CA on the client device is only needed if. With this root-CA it will accept all certificates issued by this CA, even future certificates. Which means you make TLS connections fromdepend on the same CA issuing certificates within the life time of the device. If you need to do this then you probably willYou might still need a secure way to update these root-CAs too because several root-CA will expirethe firmware in case yet another buggy TLS stack happened or regulations require the use of better cryptography within thisthe 10+ years time frame so you cannot verify connections any longer.

Yes, you need to have some secure way to update the certificate for this device. One reason is the 39 month limit, another is a possible compromise of the public key used for the certificate (how it is protected anyway for such a long time?).

And given all the recent bugs in TLS libraries you better have a secure firmware update too. Apart from that you either need your cryptography ready until the end of the 10+ years time frame or you need to have ways to upgrade the algorithms and protocols in use. Note that within this long time frame TLS 1.0 and TLS 1.1 will probably get deprecated, as do 2048 bit RSA keys. It might also be that the not yet released TLS 1.3 will be already required.

Will it only be the servers's certificate I need to replace and not the root CA on the device?

The Root-CA on the device is only needed if you make TLS connections from the device. If you need to do this then you probably will need to update these root-CAs too because several root-CA will expire within this time frame so you cannot verify connections any longer.

Yes, you need to have some secure way to update the certificate for this device. One reason is the 39 month limit, another is a possible compromise of the public key used for the certificate (how it is protected anyway for such a long time?).

And given all the recent bugs in TLS libraries you better have a secure firmware update too. Apart from that you either need your cryptography ready until the end of the 10+ years time frame or you need to have ways to upgrade the algorithms and protocols in use. Note that within this long time frame TLS 1.0 and TLS 1.1 will probably get deprecated, as do 2048 bit RSA keys. It might also be that the not yet released TLS 1.3 will be already required.

Will it only be the servers's certificate I need to replace and not the root CA on the device?

The Root-CA on the device is only needed if you make TLS connections from the device. If you need to do this then you probably will need to update these root-CAs too because several root-CA will expire within this time frame so you cannot verify connections any longer.

Large edits because now it is clear that OP is asking about devices which only work as a TLS client...

If this is only for client devices than you don't need to update the certificate on the device since there is no certificate on the device. The certificate is on the server (which you need to update) and is checked against the root-CA on the client device. With this root-CA it will accept all certificates issued by this CA, even future certificates. Which means you depend on the same CA issuing certificates within the life time of the device. You might still need a secure way to update the firmware in case yet another buggy TLS stack happened or regulations require the use of better cryptography within the 10+ years time frame.

Yes, you need to have some secure way to update the certificate for this device. One reason is the 39 month limit, another is a possible compromise of the public key used for the certificate (how it is protected anyway for such a long time?).

And given all the recent bugs in TLS libraries you better have a secure firmware update too. Apart from that you either need your cryptography ready until the end of the 10+ years time frame or you need to have ways to upgrade the algorithms and protocols in use. Note that within this long time frame TLS 1.0 and TLS 1.1 will probably get deprecated, as do 2048 bit RSA keys. It might also be that the not yet released TLS 1.3 will be already required.

Will it only be the servers's certificate I need to replace and not the root CA on the device?

The Root-CA on the device is only needed if you make TLS connections from the device. If you need to do this then you probably will need to update these root-CAs too because several root-CA will expire within this time frame so you cannot verify connections any longer.

Source Link
Steffen Ullrich
Steffen Ullrich
  • 207.5k
  • 30
  • 416
  • 481

Yes, you need to have some secure way to update the certificate for this device. One reason is the 39 month limit, another is a possible compromise of the public key used for the certificate (how it is protected anyway for such a long time?).

And given all the recent bugs in TLS libraries you better have a secure firmware update too. Apart from that you either need your cryptography ready until the end of the 10+ years time frame or you need to have ways to upgrade the algorithms and protocols in use. Note that within this long time frame TLS 1.0 and TLS 1.1 will probably get deprecated, as do 2048 bit RSA keys. It might also be that the not yet released TLS 1.3 will be already required.

Will it only be the servers's certificate I need to replace and not the root CA on the device?

The Root-CA on the device is only needed if you make TLS connections from the device. If you need to do this then you probably will need to update these root-CAs too because several root-CA will expire within this time frame so you cannot verify connections any longer.