Best practice, who should be responisble for HTTPS configuration?

Question

I work for a consultancy that develops internal and intranet web applications. We do not own or manage any infrastructure but do install and support the applications. We've had a request asking us to take over configuration and management of HTTPS/SSL on a web server. Is there any reason why this would sit with the application developer as opposed to the IT Infrastructure team who would manage and administer the server?

As I understand it, the certificate would belong to the server and should ideally by managed by those who own the server, I'm not aware of any reason that the application would need to be aware of the certificate that would require the developers to own the configuration of the web server.

What is best practice for this? especially when developers are a 3rd party working on behalf of a client.

Edit: in this instance we are dealing with straightforward LOB CRUD applications, so I can't think of any special cases that would require the app itself to do anything unusual. Not that I want to discourage answers that may apply to others who may be in that situation!

Answer 1

One edge case where it might make sense to put responsibility for ssl certificates on the app/app developers:

If your app was reachable through multiple domain names, and these domain names were controlled by the app itself, then it would make sense for the app / app developers to set up a system to automatically extend the certificate to the new list of domains whenever a domain was added.

This might also be relevant for applications which allow users to create their own subdomains, (e.g. john.example.com and jane.example.com), but I think that in that case, what you'd usually do is get a wildcard certificate which would cover *.example.com, and in that case there'd be no need for the app / app developpers to take care of the certificate).

Other than that, I don't see a reason why a third-party consultant should take care of a client's ssl certificates. In fact, I'd see it as a disadvantage, since from a security viewpoint you'd add an additional point of failure - after all, if the consultant took care of getting a certificate for the client's server, he'd also have access to the private key, and this could be a liability for both the client and the consultant:

The client could never be sure of who had access to his encrypted communications with his clients, since he couldn't know whether the consultant who got the ssl certificate for him took all the necessary care to keep the private key secure, and in case there was a breach of privacy with financial (or public) consequences, the consultant might suddenly have to show that it wasn't his fault in order not to be held accountable.

So if I were you, I'd counsel the client against outsourcing certificate acquisition and deployment if at all possible (of course, if they don't have their own tech guys, then there's no way around it).

Answer 2

I've seen the responsability of certs fall either way depending on the circumstances, but I would say that in general, it depends on whether you have a maintenance agreement with the client. If you have a maintenance agreement, then they will probably expect you to renew their Domains, Certs, etc over time; so, you should be the one to set them up. If you do not have a maintenance agreement, then that responsibility should fall on their IT personnel.