Table of Contents

Certificate Management Automation

Modern certificate management should be automated to reduce human error and ensure timely renewals. For a ready-to-use script that checks expiry dates and warns before certificates lapse, see Certificate Expiration, Renewal, and Monitoring on the Validation and Troubleshooting page.

For production environments, consider these automation tools (see the dedicated ACME section for full guides):

  1. Certbot (Linux) / win-acme (Windows): Automated ACME issuance and renewal for public domains — see the Certbot and win-acme guides

    certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com

  2. acme.sh: Lightweight shell ACME client with broad DNS provider support

    acme.sh --issue -d example.com -w /var/www/html

  3. cert-manager: Kubernetes-native certificate management

    kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml

  4. HashiCorp Vault PKI: Enterprise-grade certificate management

    vault write pki/root/generate/internal common_name="example.com" ttl=87600h
Tip

Automation best practices:

  • Set up monitoring with alerts well before expiration
  • Test renewal processes before deployment
  • Keep audit logs of all certificate operations
  • Automate distribution of renewed certificates to all services
  • Implement automated validation tests after renewal

Security Considerations

When working with OpenSSL and cryptographic operations, several security considerations should be kept in mind to avoid common pitfalls.

Known Vulnerabilities

OpenSSL has experienced several high-profile vulnerabilities. Awareness of these helps prevent security issues:

Vulnerability Affected Versions Description Mitigation
Heartbleed (CVE-2014-0160) 1.0.1 through 1.0.1f Allows attackers to read memory from the server, potentially exposing private keys Upgrade to 1.0.1g+ or 1.1.0+
POODLE (CVE-2014-3566) All versions supporting SSLv3 Padding Oracle attack allowing decryption of secure communications Disable SSLv3 support
FREAK (CVE-2015-0204) Versions before 1.0.1k Allows forced use of weak export-grade ciphers Upgrade to 1.0.1k+ or 1.1.0+
Logjam (CVE-2015-4000) All versions with weak DH parameters Downgrade attack allowing MITM attacks Use 2048+ bit DH parameters
DROWN (CVE-2016-0800) Versions supporting SSLv2 Cross-protocol attack on TLS using SSLv2 Disable SSLv2 support, upgrade to latest

Secure Configuration Principles

  1. Disable Legacy Protocols: Explicitly disable SSLv2, SSLv3, TLSv1.0, and TLSv1.1 in production environments
  2. Use Strong Ciphers Only: Configure cipher suites to include only strong algorithms
  3. Implement Forward Secrecy: Prioritize ECDHE and DHE cipher suites
  4. Secure Renegotiation: Ensure only secure renegotiation is allowed
  5. OCSP Stapling: Enable OCSP stapling to enhance certificate validation privacy

Common Security Mistakes

  1. Weak Key Generation: Using insufficient key sizes (less than 2048-bit RSA or 256-bit ECC)
  2. Self-signed in Production: Using self-signed certificates in production environments
  3. Private Key Exposure: Inadequate protection of private keys, including:
    • Insufficient file permissions
    • Unencrypted private keys
    • Storing keys in insecure locations
    • Including private keys in backups or repositories
  4. Failure to Validate: Not properly validating certificate chains
  5. Certificate Lifespans: Using excessively long validity periods for certificates
  6. Ignoring Expiration: Not monitoring certificate expiration dates
  7. Weak Random Number Generation: Not ensuring sufficient entropy for key generation

Security-Focused Commands

# Generate a secure 4096-bit RSA key with strong encryption
openssl genrsa -aes256 -out secure_key.pem 4096

# Verify proper permissions on a key file
ls -la secure_key.pem
chmod 600 secure_key.pem

# Check OpenSSL PRNG state
openssl rand -writerand .rnd

# Verify a certificate hasn't been revoked (OCSP)
openssl ocsp -issuer ca.crt -cert certificate.crt -text -url http://ocsp.example.com/

# Verify a certificate with CRL checking
openssl verify -crl_check -CAfile ca.crt -CRLfile revoked.crl certificate.crt

# Create secure Diffie-Hellman parameters (2048+ bits)
openssl dhparam -out dhparams.pem 2048

Best Practices

Key and Certificate Management

  1. Use Strong Keys:

    • RSA: Minimum 2048-bit, prefer 4096-bit for CAs and high-security applications
    • ECC: Minimum 256-bit curves (P-256/secp256r1 or better)
    • EdDSA: Ed25519 for modern applications requiring high performance

  2. Protect Private Keys:

    • Always use strong password encryption for private keys (-aes256 option)
    • Set restrictive file permissions: chmod 600 private.key
    • Consider hardware security modules (HSMs) for high-security environments
    • Never store private keys in public repositories or unsecured backups

  3. Certificate Chain Validation:

    • Always include the complete certificate chain in server configurations
    • Verify chain validity with openssl verify -CAfile ca-chain.crt certificate.crt
    • Include intermediate certificates when distributing end-entity certificates

  4. Certificate Lifecycle Management:

    • Implement automated certificate monitoring and renewal processes
    • Set reasonable validity periods (90-398 days for public TLS certificates)
    • Maintain a certificate inventory with expiration dates and renewal procedures
    • Establish a documented revocation process

  5. Naming and Organization:

    • Use consistent, descriptive naming conventions for all files
    • Organize certificates in a structured directory hierarchy
    • Document certificate usage, ownership, and management responsibilities

Implementation Best Practices

  1. Version Management:

    • Stay current with the latest stable OpenSSL versions
    • Subscribe to security announcements via openssl-announce
    • Regularly check for security patches

  2. Configuration Security:

    • Use secure default configurations
    • Disable legacy protocols (SSLv2, SSLv3, TLSv1.0, TLSv1.1)
    • Prioritize forward secrecy cipher suites
    • Configure secure cipher ordering with modern algorithms

  3. Automation and Infrastructure:

    • Use configuration management tools (Ansible, Chef, Puppet) for consistent deployment
    • Implement certificate automation with tools like Certbot, cert-manager, or ACME clients
    • Integrate certificate lifecycle management into CI/CD pipelines
    • Consider certificate management services for enterprise environments

  4. Testing and Validation:

    • Regularly scan for expiring certificates
    • Perform periodic security testing of TLS configurations
    • Use tools like SSL Labs Server Test to validate configurations
    • Implement automated testing in pre-production environments

  5. Disaster Recovery:

    • Maintain secure backups of CA certificates and private keys
    • Document recovery procedures for compromised keys
    • Create and test certificate revocation procedures
    • Establish alternate validation methods in case of CA failure

Documentation Best Practices

  1. Comprehensive Records:

    • Maintain an inventory of all certificates with metadata
    • Document procedures for certificate request, issuance, and renewal
    • Keep records of certificate parameters, including key sizes and algorithms

  2. Process Documentation:

    • Create clear documentation for certificate operations
    • Include step-by-step guides for common certificate tasks
    • Document emergency procedures for certificate compromise

References

◄ Advanced Operations · OpenSSL Guide

Edit this page