0

I was looking at the LXI Device Specification 2022 Version 1.6. For those not familiar with LXI, it is a standard for lab instruments like oscilloscopes, function generators, LCR meters and many more which have ethernet ports. You can connect these instruments to a network and control them from a PC. Usually, you can send commands to some socket interface, but they also have a built-in webserver so you can control them through a browser.

Section 9.1 of the standard requires this connection use HTTPS, but in many cases the instrument will not have a domain name. It may also not have a direct connection to the internet. This seems to pose two big problems for using HTTPS - I can't get a certificate (that a browser will trust) without a domain name. If I could it would expire after a year so the instrument would have to have a way to get a new one.

It is common for customers to use these instruments on a LAN, it seems that this is better from a security perspective than exposing the instrument to a wider world. The LXI standard requires dynamic link-local addressing, so they clearly expect use on LANs with little infrastructure (no DNS). The manufacturer does not know in advance what IP will be assigned. The customer, who is operating the network, will typically be a scientist or electronics engineer and won't usually be competent to set up their own CA (for example).

So my question is: Is there a way for a manufacturer to do HTTPS on such a device, in a way that the customer's browser won't warn about? Or is this requirement (which is new in the 2022 standard) actually extremely hard to achieve? I would classify users clicking past browser warnings, forming bad habits, as not achieving it.

There are some older questions where it looks like the answer is no, you can't, but perhaps there are new techniques since then.

Improve this question
7
  • See security.stackexchange.com/questions/121163/… for some interesting reading on this subject.
    – mti2935
    Commented Oct 18, 2023 at 11:39
  • Run your own CA (which you need to import ONCE as trusted into each system) to create your server certificates, which can also be issued for IP addresses. Or use self-signed certificates (which you need to import as trusted into each browser for every certificate and every time it changes)
    – Steffen Ullrich
    Commented Oct 18, 2023 at 12:43
  • I've edited the question to be a bit clearer, but the linked question and CA suggestion are mostly things the person running the network can do - but I'm looking for things the instrument manufacturer can do. The big benefit of these LXI instruments will fully-featured control webpages is that you can just plug them in and go - no need to install any software. Getting permission to install a certificate is probably more difficult than installing software in many enterprise environments.
    – Jack B
    Commented Oct 18, 2023 at 13:07
  • Incidentally I have a strong feeling the answer is "No, there is nothing the manufacturer can do to make HTTPS work out of the box and work smoothly". But the fact it was in the spec (and as a rule, not a recommendation) made me think there must be a new technology or something I'm missing.
    – Jack B
    Commented Oct 18, 2023 at 13:11
  • 1
    @mti2935 Yeah, I was taking the lack of HTTPS on routers as a sign that this is not easy, but did think that routers aren't always keeping up with new technology and the LXI requirement is very new. The local-ip.co thing is very interesting. I will have to think carefully about how the authentication process would work for different configurations, but it is very interesting. Using a cert for *.serialnumber.ourdomain.com would let us use a different cert on each device.
    – Jack B
    Commented Oct 19, 2023 at 11:07

1 Answer 1

Reset to default
1

Or is this requirement (which is new in the 2022 standard) actually extremely hard to achieve?

If you are limited to a standard browser without additional configuration, then this is indeed hard to achieve. Many manufacturers provide a mobile app instead of a browser interface. Users are generally familiar with installing mobile apps, and the mobile app can trust your custom CA and connect securely to your devices.

So my question is: Is there a way for a manufacturer to do HTTPS on such a device, in a way that the customer's browser won't warn about?

You could create a subdomain for each device that points to the IP address on the LAN, and get a real certificate for that domain. I wrote more about it on my blog: A method to do TLS on IoT devices

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .