I have embedded devices that are located in different cites and connected to my OpenVPN server. I initialize my devices before deploying them and put the certificate/key pair through local network. When the devices go online at the remote site they are connected to my openVPN server via private tunnel. I am using OpenVPN version:2.3.10 with EasyRSA on Ubuntu 16.04 LTS
Now the certificates are about to expire. How can I renew the certificates on these devices? I am thinking of 2 approaches.
Approach 1) A script on the device checking the validity of the certificate every month or so and when the certificate is about to expire it should send a certificate generation request(a standard https get request or similar). On the server end, only requests coming from private tunnel should be served. A certificate/key with same CN should be generated and transfered to the client.
Problems with apporach 1)
- How should the cert/key pair be transferred securely ? i dont want to exchange clients private key via network.
- The whole process should be automated so i can also not put the key manually.
- How should the cert/key generated on the server? i also dont want the apache web user i.e www-data to have access to my easyRSA folder.
Approach 2) Generate Private key at the client end (my embedded device). Create a Certificate signing request (CSR) send it to OpenVPN server (which is also my CA). The CA generates a certificate and sends back the client certificate.
Problems with apporach 2)
How to authenticate CSR ? how can i know that the CSR is coming from my embedded device and not some attacker. The only way that i can assure is, if the CSR is coming from the private tunnel.
In case if the certificate on my embedded device expires before renewal then the private tunnel would not exist. How can i authenticate CSR in this case?. Any one with CA.crt (CAs public key) can generate a private key and send a CSR to CA.
I think approach 2 seems more reasonable and secure but i dont know the solution to the problems i am facing. I want to know if I have a correct understanding of security? or if there is something I am missing. Also if i go with approach 2, how would the implementation look like? i know the theory but i dont know how to create CSR and send it to CA. And on CA end how to receive a CSR and generate a cert and send it back.