5

I develop IoT (Internet of Things) devices on small embedded systems, where it is very difficult to update the local certificate once they have been deployed. It really needs to be avoid if it can.

With the new 39 month age for TLS certificates, I am trying to understand how this will effect my development options.

I will usually install a Root CA from Baltimore or others on the device during the manufacturing process. But will this now mean that I will need to update the certificate on my device every 39 months?

Or have I misunderstood what is going on. Will it only be the servers's certificate I need to replace and not the root CA on the device?

Basically I need to understand what can I do to ensure I do not need to replace the certificate for the entire life of the device. Hence it will need to be in the 10 years + time frame.

Solution Architecture

Embedded Device <----Internet----> Cloud Service (Server)

The Embedded Device is the client which has a ROOT CA installed to enable direct communication over TLS 1.2 with the Cloud Service (Server)

The type of devices we are talking about are small embedded devices like those used in smart meters or sensor nodes for factories or agriculture. They could be deployed into the millions potentially.

Improve this question
5
  • possible duplicate of TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error
    – Lie Ryan
    Commented May 12, 2015 at 11:58
  • @LieRyan I don't think that answers the OP's question, it's just loosely tied by the 39 month certificate.
    – RoraΖ
    Commented May 12, 2015 at 12:04
  • Also, I cannot create my own certificates for this purpose, it has to be from one of the top tier suppliers due to internal corporate security rules and practices
    – Remixed123
    Commented May 12, 2015 at 12:07
  • Do you even use public hostnames for the device, i.e. no company-intern or .local or similar? Because otherwise you will not get a certificate from a public CA at all.
    – Steffen Ullrich
    Commented May 12, 2015 at 12:18
  • It is for an IoT device, this communication is happening over the Internet. So the server will have a public domain name.
    – Remixed123
    Commented May 12, 2015 at 12:26

1 Answer 1

Reset to default
2

Large edits because now it is clear that OP is asking about devices which only work as a TLS client...

If this is only for client devices than you don't need to update the certificate on the device since there is no certificate on the device. The certificate is on the server (which you need to update) and is checked against the root-CA on the client device. With this root-CA it will accept all certificates issued by this CA, even future certificates. Which means you depend on the same CA issuing certificates within the life time of the device. You might still need a secure way to update the firmware in case yet another buggy TLS stack happened or regulations require the use of better cryptography within the 10+ years time frame.

Yes, you need to have some secure way to update the certificate for this device. One reason is the 39 month limit, another is a possible compromise of the public key used for the certificate (how it is protected anyway for such a long time?).

And given all the recent bugs in TLS libraries you better have a secure firmware update too. Apart from that you either need your cryptography ready until the end of the 10+ years time frame or you need to have ways to upgrade the algorithms and protocols in use. Note that within this long time frame TLS 1.0 and TLS 1.1 will probably get deprecated, as do 2048 bit RSA keys. It might also be that the not yet released TLS 1.3 will be already required.

Will it only be the servers's certificate I need to replace and not the root CA on the device?

The Root-CA on the device is only needed if you make TLS connections from the device. If you need to do this then you probably will need to update these root-CAs too because several root-CA will expire within this time frame so you cannot verify connections any longer.

Improve this answer
9
  • This is quite painful to think about. Many devices have hardware cryptography, and libraries burnt into ROM. Even if available, they will not be able to be updated. I am using a root ca that is valid till 2025, will this not be affected by this situation ?
    – Remixed123
    Commented May 12, 2015 at 13:11
  • Since you are talking about 10+ it will be affected. And there might be intermediate CA involved with a shorter life time. Apart from that it might be also hard to get a computing device where the hardware will still reliably work in 10+ years.
    – Steffen Ullrich
    Commented May 12, 2015 at 13:31
  • I'm a little confused about the edit you made, regarding several root CAs expiring. These devices will use TLS 1.2 to directly connect to a cloud service. The devices will always connect to the same cloud service, they will only have 1 root CA installed (I already have this working). The types of devices we are talking about are smart meters for homes, sensor nodes through out factories or agriculture. We are talking potential extremely large numbers.
    – Remixed123
    Commented May 12, 2015 at 13:49
  • Such information would have been really helpful in the question. Are you IoT devices just TLS clients only? In this case the whole issue is different since thy do not contain the servers certificate at all. I think you should update your question so that it contains all the details (like the architecture) which are necessary to fully understand your problem and to give a useful answer.
    – Steffen Ullrich
    Commented May 12, 2015 at 13:53
  • 1
    Actually, these are just basics of TLS and the associated PKI (i.e. CA infrastructure). So any book or deeper article about this topic should cover this.
    – Steffen Ullrich
    Commented May 12, 2015 at 14:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .