2

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client.

How is the same thing typically implemented on private networks, with large numbers of short-lived hosts, such as in an autoscaling cluster? Copying the public key of every host to every other host would not scale well if hosts are frequently being created & destroyed.

Do people usually set up a private CA? Or use a symmetric key approach like Kerberos? Or some other approach? Are there any specific approaches recommended or provided by cloud providers, like AWS, GCP or Azure?

Note: I'm not asking for the technical details of how to set this up. I'm asking what the general approach is.

  • 1
    How this is done in private network is by running your own CA. It's very common practice and is a little bit like asking how to bake your own cookies. But after that, you ask about how it's done with autoscaling clusters, which I don't know! The CA system would perfectly work, but I can imagine there are some considerations that are not relevant in a regular setup. That's a good question. Perhaps it makes sense to focus the question on that? Could you clarify what properties you're looking for, e.g. mutual trust between the client and server, or just one way? – Luc Mar 7 at 12:29
  • Potential duplicate: security.stackexchange.com/questions/16740/… – schroeder Mar 7 at 12:42
  • 2
    Possible duplicate of Internal SSL Certificates? – yoozer8 Mar 7 at 14:29
  • @Luc - Is that the way cloud providers recommend you do it? And do they generally provide tools to do this? (By the way, you could turn your comment in to an answer.) – aco Mar 7 at 22:40
  • @schroeder and yoozer8 - Those questions are about setting up SSL certificates. I'm not asking how to set up an SSL certificate. I'm asking whether setting up an SSL certificate is the recommended way to solve this problem, or whether another approach like Kerberos or manually distributing public keys is the more common way to solve this. – aco Mar 7 at 22:43
2

An internal CA is the usual approach. You can generate certificates for each server with a short renewal time and have the internal CA root installed on your internal client machines (e.g. via group policy). You then set up some certificate management infrastructure to help you generate and deploy certificates.

As an example, Kubernetes maintains a CA per cluster, which allows each component and workload to securely communicate during administration tasks. They utilise CFSSL for doing the heavy lifting, which is the same toolset that allows Cloudflare to automatically deploy and manage certificates at scale.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.