I have the following scenario:
- Several independent embedded servers (Linux/ARM/lighttpd)
- Several independent controlling devices (win32/iOS/Android)
- Each server should have at least one controlling device
- Each controlling device can control one or more servers
- None but the controlling devices should be able to contact servers
I understand I could use Client Certificates to ensure "device/server pairing", but I am unsure if at all possible and (eventually) how to setup my systems to fulfill the following additional requirements:
- Hassle-free Client Certificate installation: I mean I would like to have some automated procedure initiated on the server (possibly via physical push button) which will create and deploy a specific Client Certificate (something akin to "Wi-Fi Protected Setup").
- Role-based certificate creation: each controlling device should have a "role", meaning it can perform a defined set of operations on the server; essentially I need just to embed some data in the certificate at creation time.
- Client Certificates should be expiring and revocable (I think this is standard, but must be allowed-for while creating the certificate itself).
Real question is how to setup (1), where I have little clue. I have searched the Internet, but I found only the "normal" way (generate cert, self-sign, manually import into browser) which is way too complex for my Customers :( ; I was hoping to be able to generate a URL (or print a Qr) that, entered on controlling device, would "automagically" configure its browser (possibly with just some simple "OK" confirmation). Is this (or something equivalently dumb-proof) possible, somehow?
Advise and comments on the other issues are welcome (of course!)
NOTE: I am not requiring bank-proof security, just a reasonable compromise; focus is on how much I can achieve "without bothering users" (entering a password is considered bothersome, unfortunately).