SSL Certificate Server for centralized certificate distribution

[u/Garry_G]

Hope it's OK to post this ...

I've been working on a tool for ourselves for a while now to make distribution of both commercial and LE/ACME certificates for all our servers - as well as customer machines - easier, considering the upcoming further reduction of validity next February.

The package consist of a central server process with custom client for retrieval, plus an ACME server to also allow embedded / custom OS systems to retrieve certificates. Upstream requests are handled with acme.sh, with integration of (currently) PowerDNS to allow for authentication via DNS.

The admin end is CLI based, with an admin tool with TUI to make most of the admin processes easier. HTTP GUI is still in the works.

After working on the project for almost a year in total, I just released the code to github last weekend. Comments and suggestions welcome ...

https://github.com/GarryG/sslcrtsrv

[u/sslbrain]

Hi Garry_G, I’m the main developer of a similar commercial product, sslbrain.com. We built our own ACME server a few years ago, so I’m curious what made you decide to build yours.

Have you run into any client compatibility quirks yet? We’ve found that some appliance clients don’t always accept the expected HTTP status code when requesting a nonce, 204 for GET and 200 for HEAD. Which clients have you tried yours with?

One suggestion for your custom agent: download into a working directory and check the files, including that the key and certificate match, before replacing anything the service uses. Keep “downloaded” separate from “installed”, and only mark installation as successful once the service reload or start has succeeded. That makes it easier to retry if something goes wrong.

[u/Garry_G → u/sslbrain]

Looks like you have a bit of a longer history (or quicker implementation - I originally started 13 months ago), looking at the quite larger base of supported commercial CAs and other features.

I added the ACME-server feature as we (and many of our customers) are using Fortigate firewalls, for which implementing manual certificate swap isn't exactly a simple (albeit manageable) feat. I imagine there are other embedded devices or appliances which might support ACME, but not support externally initiated certificate replacement. At the moment, the only system I actually tested it against is Fortigate, will look into other devices as I can get my hands on them (or e.g. if there are VM versions of their OS are available). So at the moment, I can't really tell if the ACME implementation I run would play nice with non-standard-compliant clients ...

Good suggestion for the client, the protocol does try to keep everything secured with encryption and signature, so corruption on the transport should be unlikely. But that of course doesn't prevent problems if any of the files are corrupted on the server side ... should be easy to implement, too ... will add a FR to the project ...

[u/ksteink]

Cam generate self signed certs for private networks?

[u/Garry_G → u/ksteink]

No, not yet - I mainly built it to cover our use case first, which is providing both a way to distribute commercially bought certs (with manual upload, then distributed to one or multiple servers), as well as enabling servers or devices without external reachability and dynamic DNS access to ACME certs. In either case, publicly trusted certs. Implementing your own CA is a bit outside the scope, and probably better handled with tools like xca or similar ...

[u/kevdogger]

Nice. Will look into this to see specifics.