ACME: generating and managing LE-certs for internal web-services

johnpoz

Why would you need 3 CA's? Makes no sense.. You could have a 100 sites in your org, only 1 CA needed..

Setup your dns correctly with different subdomain for each site, then setup domain overrides for your different domains and there you go all sites resolve everything through your site to site connections.

sitea.domain.com
siteb.domain.com
sitec.domain.com

You do understand 1 CA can sign off on certs for any domains you want right? Be it your public domain even. As long as you trust the CA anything it signs will be trusted.

sgw

@johnpoz I tried something like that already but didn't get the domain overrides to work.

I have that sitea/siteb/sitec setup already but the DNS-overrides never worked. Maybe I missed some firewall-rules or so, I have to recheck things. Is it important to use DNS resolver or forwarder, or should that work anyway?

The one central CA would "sit" on one pfsense only right? The distribution of the certs would happen manually?

johnpoz

Have no idea what you tried. But simple domain override is all that is needed to be able to query a specific nameserver for fqdn, etc.

Yes the certs would be issued manually. Where the CA sits means nothing - could be on your PC, could be in the cloud.. Just pointing out that pfsense comes with a simple to use gui to a CA.. Since you have pfsense, why not leverage its CA interface if you want to create certs for your devices that your going to trust.

Does not matter if you used forwarder or resolver or even resolver in forwarding mode. Domain override would be the same.

sgw

OK, I watch some pfsense hangouts about DNS etc to learn more of the necessary basics.
And then I will try to setup my internal CA etc / thanks so far

johnpoz

@sgw

I have multiple posts about on how to trust cert you created.. But with the change to new forum old pictures might be gone? If you need some help on how to trust your cert just ask.

sgw

@johnpoz status: I set up a Root-CA and a intermediate "Sub-CA" as shown on youtube.
As far as I understand I now would have to import the Root-CA (and the Sub?) into each client (=PC) using all this.
My Fedora 28 desktop does not like to import these crt-files ... I have to research that in more detail.

And I tried to upload a generated cert and its key to a TP-Link switch, it accepted the cert but not the key.
Tried a shorter one, failed as well.

johnpoz

@sgw

Personally I don't see the need for the intermediate in such a setup..

Which tp-link switch do you have? Can you just create a CSR and sign it with your new CA? I have a cheap one on my shelf I could try.. My cisco sg300s were a bit picky as well on how to install certs. But the CSR was the easy way to do it.

As to fedora... Where are you trying to install them - it would just be done in your browser to trust the CA. Doesn't really matter what OS the browser is running on. What browser are you using.

sgw

@johnpoz It's a TL-SG3424P and it does not allow creating a CSR, just upload key and cert. Didn't find specs for key length or so. I will retry in the next days ... thanks so far.

johnpoz

Sorry I do not have one of those to play with or would for sure.. Let me see how much they cost.. Can always throw it in my lab for testing and helping others with same model and vlans and such.

did you see this?
https://forum.tp-link.com/showthread.php?77360-Invalid-SSL-key

The key you export from gui will be in base64 pem and rsa.. But maybe the switch doesn't like the .key ext vs .pem?

BTW they are very pricey on amazon - even the non poe model. And its latest firmware is from 2015? Arrrgghh..

sgw

@johnpoz

The link you posted looks promising, I will try that maybe tomorrow ...
Ah, what the heck: tested that, works! thanks

My customer bought TP-Link because they were cheap back then! ;-)

johnpoz

@sgw

So you just changed the extension to pem vs key. you should not have to run that through openssl - its not going to do anything because the key is already in the correct format.

Glad you got it sorted... Make the certs good for 10 years so you won't have to dick with them again. And put SAN on them for IP while your at it would be my suggestion.

sgw

Yes, thanks for the suggestion.
I plan to restructure my local DNS as well and will watch a pfsense hangout around this to maybe get an idea how to do that. After DNS works -> certs ;-)

JeGr

@sgw if you've got problem importing certs or CAs into things like switches etc. make sure which format they need. Some won't like normal PEM style format and want sth like PKCS8 or PKCS12 format. Others want key+cert in the same file. :)