We are developing a product (device / system) that will be installed on customer sites. Many of our customers will (should) be concerned about security, and should be thinking about it seriously.
Our product provides an API via HTTPS, which is used by the built-in UI and is also open for use by customers.
I'm looking for information and advice on how to deal with the SSL certificates that are installed in our product when they leave the factory.
I would appreciate any input - have we overlooked or missed anything?
As It Stands Today
Currently (the system is in development) we are installing the same self-signed certificate into every development and prototype unit. This clearly has no chain of trust and the user will see a warning.
I believe that this is the same approach taken by other manufacturers (e.g: Cisco, Ubiquiti), but confirmation would be appreciated.
Customers will be able to provide their own certificates, signed in whatever manner they wish (publicly, or privately). This will give them the chain of trust, and will allow them to be sure that they really are connecting to *that* system.
Installing a different self-signed certificate on each unit. I'm not sure there is any benefit to doing this over sharing a single self-signed certificate across all units, as the certificate is still untrusted.
Installing a publicly signed certificate on each unit that leaves the factory. As far as I can tell, this will not work. Certificates are tied to a FQDN (possibly with a wildcard), and as such there is no way for us to generate and sign a certificate for the customer.