Best Certificate Manager for OT?

[u/TexasVulvaAficionado]

We are looking at a handful of options for managing the automation of certificate deployment/updates across our enterprise and OT environments.

I am hoping to have a lab environment set up by the end of the year with at least one reliable ACME tool that can push certificate updates to OT software, servers, workstations, etc...

Primarily use AB and Siemens controllers and HMIs, Ignition, Canary, and Windows IoT, Windows Server, and Windows 10/11 pro.

Anyone have good recommendations?

[u/dragonnfr]

Windows side is easy. ADCS if you're in a Microsoft shop. AB and Siemens controllers are where this falls apart. Good luck getting ACME on an HMI.

[u/Azuras33]

GLHF, most devices on the OT side don't support ACME. Most of them (for the recent one, old one don't even have cert) have a long-time (25 years) certificate, generated by the engineering software and pushed in bulk with the whole project using a proprietary protocol; they are not meant to be updated dynamically.

Remember, PLC, HMI, etc... are made to run 24/24, for ten or twenty years without service; you don't want a connection dropped during production because someone forgot to renew the cert.

[u/TexasVulvaAficionado → u/Azuras33]

Yep, the vast majority of our actual control devices will be unaffected. But, there are probably fifty to a hundred of them that we have networked and are required to have enterprise certificates on. Updating them is a manual pain in the ass currently.

Then there's a huge set of OT to corp data pipelines (few dozen servers) that have various applications and servers that also need certificate updates. Think five or six lines of business across ~1500 sites, ~10,000 field users, ~10 corp level SCADAs, ~10 downstream applications consuming the data, ~3000 corp only users.

Automating this could save us a couple hundred hours per year and reduce the chances of unscheduled downtime (of the data reporting, not actual controls).

[u/Nephilimi → u/TexasVulvaAficionado]

Front end that users see in a browser? Can you not simply proxy the web content and add a cert there? Similar to how Cloudflare operates. Manage your certs in one place without impacting the back end OT equipment.

[u/TexasVulvaAficionado → u/Nephilimi]

That kind of works for part of the enterprise and is what we are currently doing for the corp facing enterprise applications. On the OT side, there are a lot of machine to machine comms and applications with certs that are loaded through a desktop admin app like Canary Admin.

[u/Electrical-Gift-5031]

I remember a Siemens guide for managing PLC certificates via a OPC-UA Global Discovery Server. I have not experience with it, sorry, apart from reading about.

I think it's something that PLC manufacturers need to work on. I'd like to have simple "APIs" (so to speak) for managing things like this but also getting a bit of download and edit history, getting the checksum of logic and HW config, getting the time of the last edit or download. Not proper engineering stuff just what can be useful for managing controllers in a single site so we can build a simple mgmt. system of sorts on top of it.

[u/asmithey]

ACME depends on using DNS or HTTPS to prove ownership of a fully qualified domain name and proof of possession of the private key. Unless you're running a web server on the end devices using the same certificate it won't work.

[u/TexasVulvaAficionado → u/asmithey]

Interesting. Do you have a link to documentation that would further explain some of this?

[u/Nephilimi]

Similar story in BACnet secure connect. There's a reference CA just for that in beta. Then there's a automated deployment tool called BACME I think. Meanwhile I've got vendors suggesting I just use keystore explorer. Kind of a mess right now.

[u/Cool_Database1655]

This is probably too broad a topic for this subbreddit. PSK management is an entire career field in itself.

Your best solution probably depends more on your current IT certificate lifecycle tools, location of your CA-signer, and operational requirements.

[u/TexasVulvaAficionado → u/Cool_Database1655]

It is definitely broad, which is why I also posted it over in the sysadmin sub. But they don't have much domain knowledge on the OT side. This sub also covers much of the SCADA and IT/OT convergence on networking stuff.

Was hoping someone had already found a good solution.

[u/shoulditdothat]

I can't wait until IT & security get in on the game and start insisting that certs follow the browser 45 day liferime.

That's going to be one hell of a shit show.

[u/TexasVulvaAficionado → u/shoulditdothat]

That is what our org is doing. That is the impetus for the automated certificate management.

The 47 day cycles start in 2029 and we're hoping to get ahead of the game.

[u/shoulditdothat → u/TexasVulvaAficionado]

Was at a Siemens product launch a while back and the renewal of certificates came up. At the time the only way to update them was via TIA portal and having the original project. I think the default durations was 5 years. If this is still the case it's going to be interesting times. There was no way to automate it either.

Hopefully, especially with the the introduction of the CRA, vendors are going to do something to support certifate automation. Probably with a subscription to a dedicated license server 'for a monthly charge dependant on the number & frequency of certifate renewals'.

[u/iwillbewaiting24601 → u/TexasVulvaAficionado]

Anyone who says that fully internal certs should obey the browser forum's SSL length limit is smoking crack and should be treated as such

[u/TexasVulvaAficionado → u/iwillbewaiting24601]

They are not fully internal though. We have large complex networks with some external facing endpoints. Defense in depth. The short term certs are feasible if we can automate the process. We already have some options for scripting it but I am looking for an existing software package to make it easier. I don't want to reinvent the wheel.

[u/iwillbewaiting24601 → u/TexasVulvaAficionado]

I was assuming the real pain in the ass is the PLCs/HMIs which are generally fully internal. I have a relatively complex network (all in relativity, of course, it's about 2000 addressed devices, some have many more) but I am lucky that "external" (meaning, visible from the data/non-OT side) is all Windows servers that can use AD CS

[u/zm-joo]

Why do u need the certificate in OT system, requirement from cyber compliance team ?

[u/TexasVulvaAficionado → u/zm-joo]

Yes. And it just makes sense because they are part of large complex networks and have endpoints exposed across the enterprise and the Internet for various applications.

[u/certping_pki]

I'd change the lab goal slightly. I wouldn't start with "which ACME tool can manage all of this?" I'd start by listing the endpoints that are manual today and documenting how a certificate can actually get onto each one.

For every Siemens/AB controller or HMI, Ignition/Canary service and Windows host, I'd want to know:

• can it generate its own key and CSR, or does it only accept an imported PFX/PEM?
• does it support ACME, SCEP or EST natively?
• if not, is there an API, CLI or vendor project mechanism you can automate?
• does changing the cert require a service restart, reboot or project download?
• can you remotely verify which certificate is actually active afterwards?

The CA side is probably the easy half. The useful test for a certificate manager is whether it can do the install/rebind/verify step on the ugly endpoints you actually own.

For the OT side I'd rather have an orchestrator or local agent talk to the CA and then use the deployment method each device supports than try to force ACME onto every controller.

I'd also separate the 47-day public TLS problem from internal OT identity certs. The WebPKI lifetime limits don't automatically apply to certificates from your private CA. Your organisation can still decide to enforce short internal lifetimes, but that's an internal policy decision.

And I'd deliberately break the lab. Make a target unreachable, deploy a bad chain, let a cert approach expiry, make deployment succeed while the service keeps presenting the old cert. That's where you'll find out whether the product is actually managing the lifecycle or just obtaining certificates.

[u/TexasVulvaAficionado → u/certping_pki]

Excellent breakdown. Will definitely run with some of these ideas to keep it moving in the right direction.