Scenario: I need to implement MTLS between three of my services communicating with each other.

Based on my understanding of MTLS, I need to import the certificate of target services in the trust store of the source service and the certificate of source service in the target service. My certificate requires renewal every 15 days. At the time of renewal of each certificate, I need to go to the other services' trust store where the certificates are stored and update the certificate. e.g if I want to update the certificate of service-1 I need to go to service-2 and service-3 trust store as well and update the certificate there as well.

This seems to be a lengthy and unmanageable process once the size of infrastructure will increases. Based on the information available on the internet I have found that HSM can be used as a centralized certificate store and no matter the size of infrastructure certificate renewal can happen at a single shot at HSM itself.

But what is the way to handle the MTLS? How do source service and target service exchange the certificate if it is not stored on their local but in HSM?

  • I don't have a good answer to scaling, other than that using a TPM on the hosts might be a better solution than centralising things with a HSM. However, re-issuing certificates every 15 days comes across as a red flag. Why are you cycling them that frequently? There's no cryptographic justification for cycling them like that, and it turns the automated certificate cycling process into a high-risk attack surface.
    – Polynomial
    Oct 8 '21 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.