1

Have a number of private network services deployed on different nodes outside of optionally encrypted mesh systems, like Docker or Consul.

The services have high value and should communicate via TLS only, currently using OpenSSL.

Once the certificates are about to expire in production environment, should they be renewed manually by sys-admin or it may be automated somehow?

Is it secure to use cron tasks for this?

Improve this question
1
  • 1
    There is no real difference between creating a new certificate a renewing one - except that you could reuse the CSR for the latter in case you want to keep the key pair. Thus, just follow the process you currently use to issue new certificate - whatever this process is in your specific case.
    – Steffen Ullrich
    Commented Dec 23, 2018 at 12:11

1 Answer 1

Reset to default
1

Certificate renewal can be automated as long as entire procedure (workflow) is well defined, transparent and approved within your company (by security team). You can use scheduled tasks (cron, in your case) to

  1. track existing certificate validity
  2. Once the certificate is about to expire (passed 80% of lifetime, for example), generate new CSR on target system
  3. Submit CSR to CA server
  4. Retrieve issued certificate
  5. Bind new certificate and associated key pair in applications (web server).

When the whole process is secure (that is, keys are generated on target system and do not leave it, CSRs are validated/reviewed and authenticated on CA server and so on) I don't see why it can't be automated.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .