2

My company is a IoT-Gateway manufacturer. Customers are increasingly getting serious about security issues in the IoT domain. Additionally, governments require dedicated security features as HTTPS for embedded web severs.

For example, the German government agency for security in IT-systems (BSI) requires to use "TLS 1.2 in combination MIT Perfect Forward Secrecy" as minimum security.

My questions are:

  • From an IoT manufacturer's point of view, is an "upload certificate" feature in the IoT device sufficient to ensure certificate security?
  • Are there already a standard API (or RFC) to replace certificates? Considering large IoT installations the replacement and management of certificates is defitively a big challenge.
  • How do companies manage the HTTPS certificate infrastructure for IoT devices today? Are self-signed certificates used in Intranets or official certificates? Does every IoT gateway get a different certificate? Do companies operate private certificate authorities?
1

Many companies (like fortinet, stormshield, ...) use selfsigned certificates. They have a internal PKI which produce these certificates but they are not trusted by web browsers.
Many of them permit to upload the owner certificate. There is no big deal with this operation except that permissions must be carrefully configured

What do you need is probably a PKI to manage your own certificates. Then, you can set a secured https channel if you control the gateway and the client.
If you do not control the client, you cannot force it to trust your Certification Authority (CA), so you cannot ensure that https between the gateway and the client is safe (man is the middle is possible).
So you can propose to clients to add your CA as a trusted one or make your CA be signed by a certification well known authority (comodo, verisign, etc.)

  • Ok, I understand that browsers can handle self signed certificates by manually accepting the certificate. But what's about API clients that have to accept certificates. They may fail in a large scale. How is this handled? – WeSee Sep 29 '17 at 13:02
  • 1
    The point is not that a web browser manually accept an untrusted certificate raised by the gateway. The design I described was about your CA directly inserted in the trusted CA store (for example in linux like systems you should find it under /etc/ssl/certs/). In this way, you will not receive any security alert to accept or reject, the entire system is trusting your CA. Now you have to worry about how to securely transmit your CA to the IoT client without be intercepted or aleterated – Sibwara Sep 29 '17 at 13:32
  • 1
    You also have to worry about renewing your certificates and CA periodically (because key lenght expire at a time) – Sibwara Sep 29 '17 at 13:33
  • Good point. To distribute the certificates for renewal it would be helpful if there are standard protocols (as OSCP Online Certificate Status Protocol to check certificates) for updating certificates without user interaction. Do you know about such protocols? – WeSee Sep 29 '17 at 13:37
1

I suggest that the critical part would be the ability to add and remove certs from the device, and to set/change any passwords.

If the device is acting as a server then the definition of certs is the server certificate(s) and private key(s). If the device acts as a client or validates client certificates then the definition includes ca certs. If you are not using client certs then you need some other way of authenticating management operations (e.g. password).

So that's at least 3 security related functions.

While CMP/rfc6712 springs to mind as a method for renewing a certificate, it strikes me that you probably should not initiate the certificate renewal on the IOT device.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.