We're planning to implement following scenario for a secure machine-to-machine (M2M) communication network. We have some gateways and a lot of secure sensors which should only be able to "speak" to each other if they can authenticate themselves. No DNS is available, thus everything is working IP-address based.

The gateway will have a gateway.crt and gateway.key most probably stored inside a TPM. The gateway.crt is signed by an internal CA. The corresponding CA certificate CA.crt is stored on the gateway. The gateway.crt is created once during the production process. All gateways will have the same CN="TrustedGateway".

Each sensor will have it's unique sensor.key and sensor.crt. Sensor.crt is signed by CA.crt during production of the sensor and CA.crt is stored on the sensor in it's list of trusted CAs. All sensors will have the same CN="TrustedSensor".

Communication will be done using SSL / TLS with both server and client authentication required. In my understanding, the communication and connection establishment should work as both device types (gateway, sensor) have the CA.crt in their list of trusted CAs. What I'm unsure about though, is that all sensors and gateways have the same CN="TrustedSensor" / CN="TrustedGateway". Is there any security issue with this approach of all sensors and gateways having the same CN?

  • As I tried to explain above, there are no DNS servers available. So the CN will have to include the IP-address of the device directly. Howver IP-addresses might change, are configurable, are assigned at random and so on. So the gateway will have to issue a new gateway.crt whenever there's a new IP-address, that's why it has to act as a CA. – TrinityTonic Jun 20 '18 at 9:24
  • Until now I had the understanding that the CN must be the IP address if no DNS was available, but that's not the case. Thus only the CA certificate would be stored on the gateway. I edited the description*. – TrinityTonic Jun 20 '18 at 12:16
  • 1
    In that case, let me clean up my comments :) – Marcus Müller Jun 20 '18 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.