The authenticity of those sending emails or running websites is questioned every day, as attackers will pretend to be someone they are not to compromise sensitive data of Internet users. The easiest way to prove this authenticity is through use of a digital certificate. Digital certificates utilize key pairs that only the creator of the key pair can own, thus proving they are who they say they are. The certificates are also created and signed by trusted authorities called Certificate Authorities, or CAs. CAs utilize a Chain of Trust, leading back to the original CA which is kept offline and secure, to ensure it cannot be compromised.
Certificates are not just created and given to users, however. They follow an important lifecycle which works to protect and renew certificates, so they can be continually used without fear of attackers stealing them and masking themselves as the owner of the certificate. The trust in certificates created by a certificate authority begins with the assurance that its certificate lifecycle is well managed and immune to compromise. The certificate lifecycle is extremely important to implement, as it is the equivalent of the identity of the user it is issued to.
Why is the Certificate Lifecycle important?
One of the reasons implementing the certificate lifecycle is important is due to what certificates are used for. Certificates identify websites and users on the Internet, meaning if a certificate were compromised at any point in its lifecycle, an attacker could pretend to be that person, and the user who that certificate belongs to would be blamed for any attacks associated with that certificate. Also, since the user’s key is associated with their digital certificate, that key would also be compromised, as would any data that was encrypted by that same key.
Another reason to maintain a strong certificate lifecycle is its use with websites. A compromise of a website’s digital certificate can result in outages, causing losses for the organization whose website it is. The website could also be used to infect user’s computers with malware or execute phishing campaigns, under the guise of the website owner. The first step to the proper implementation of a certificate lifecycle is knowing what each stage of the lifecycle is, and how to protect each stage.
What are the stages of the Certificate Lifecycle?
The stages of the certificate lifecycle are as follows:
Discovery
The discovery phase of the certificate lifecycle involves searching the network for missing,
expired, compromised, or unused certificates that must be revoked, renewed, or replaced. This is an important part of
the process, as it finds gaps in the security of certificates and relays these gaps to the monitoring phase, allowing
for the sealing of these breaches. Normally, this phase also deals with the inventorying of certificates to help in
future Discovery phases, along with any certificate audits that may occur.
Creation/Purchasing
This is the phase where the certificate is created. An online user, organization, or device requests a certificate from
a Certificate Authority, which contains the public key and other enrollment information needed to enroll the user. The
CA then verifies the given information and, if it is legitimate, creates the certificate. The Certificate Authority used
to create the certificate can be owned by the organization that desires the certificate, or by a third-party. If the
certificate is obtained from a third-party, then it must purchased from them.
Installation
The installation of the certificate is straightforward, but still just as important. The certificate must be installed
in a secure, but reachable, location, as users attempting to verify the authenticity of the certificate must have access
to it. When the certificate is installed, the CA puts policies in place to ensure the security and proper handling of
the certificate.
Storage
As previously mentioned, when the certificate is installed, it must be in a secure location to prevent compromise. It
should not, however, be so secure that the users that need to read the certificate cannot reach it. The proper policies
and regulations to implement for storage of certificates will be discussed later in this document.
Monitoring
Monitoring is one of the most important stages of the certificate lifecycle. This is an almost constant phase where the
certificate management systems, whether automatic or manual, watch for breaches, expirations, or compromises of digital
certificates. The Monitoring stage uses the inventory created in the Discovery phase to keep track of when certificates
should be revoked, renewed, or replaced. The certificate management system then moves those certificates to the next
phase, which can be renewal, revocation, or replacement.
Renewal
Renewal of a certificate occurs when the expiry date of the certificate is reached. This occurs naturally with
certificates, as best practice is to not use a certificate for more than 5 years at the most. Certificates can be set to
renew automatically, or a list can be kept of certificate expiration dates and the administrator of the certificates can
renew it at the proper time.
Revocation
If a certificate is found to be compromised, stolen, or otherwise negatively affected, then that certificate will be
revoked. When a certificate is revoked, it is put on a Certificate Revocation List (CRL). This list ensures that other
CAs know that this is no longer a valid certificate.
Replacement
When users switch from paying for certificates to creating their own Public Key Infrastructures (PKIs) and CAs, the
certificate is replaced. This is rarely done, as it is much easier to just renew a certificate from the original
provider rather than replace that certificate.
Protection of each phase of the Lifecycle
Each portion of the certificate lifecycle requires its own level and methods of protection. The Discovery phase acts as a security measure in and of itself. By searching for expired or missing certificates, breaches can be detected before they become an issue. The Monitoring phase is similar, as it monitors for expired, improperly implemented, or compromised certificates. Both of these phases can be automated to allow for a better detection process. There is the potential for a manual management system missing a compromised or expired certificate.
The remaining phases require a strong level of protection and authentication. The Creation stage should ensure that the CA issuing the certificates has a valid Chain of Trust each time a new certificate is created. Installation should be correctly, as poorly implemented certificates are a breach of security that an attacker can leverage for malicious purposes. The Storage phase needs to have strong security, so that the certificates are not compromised and misused by threat actors. The revocation, renewal, and replacement of certificates must also be done securely and correctly, as these stages begin the cycle again from the beginning.
Digital certificates are used across the Internet to authenticate users exchanging data with one another. Since every legitimate website uses a certificate, certificate management is extremely important. If a certificate were to be stolen and misused, an attacker could pose as another, more legitimate, source and infect a user with malware via their website. The expiration of a certificate of a certificate can result in an outage, causing an organization to lose out on potential customers. These are just a few reasons to learn more about certificate management.
What is Certificate Management?
Certificate management is the process of monitoring, processing, and executing every process in a certificate’s lifecycle. Certificate management is responsible for issuing, renewing, and deploying certificates to endpoints (servers, appliances, devices, etc.) so that network services are uninterrupted. Certificate management should also automate tasks (issuing, renewal, and so on), as well as provide real time status of the infrastructure of the network.
Certificate management helps manage the network and prevent interruptions and downtime, while providing a detailed monitoring of the whole infrastructure. Good certificate management plans should be able to handle any network, even ones with thousands of devices. If a certificate expires or is misconfigured, catastrophic outages all over the network may occur.
What is a Digital Certificate?
Any discussion of certificate management would be incomplete without explaining what a digital certificate is. A certificate, also known as an SSL/TLS certificate, is a digital identifier for users, devices, and other endpoints within a network. Certificates are linked with a public/private key pair and verify that the public key, which is matched with the valid certificate, can be trusted. The main job of a certificate is to ensure that data sent across a connection between a user and a server is kept private. The certificates does this by encrypting and decrypting data as it is sent across the connection. This is achieved through something called an SSL/TLS Handshake.
TLS Handshake
A TLS Handshake is executed as follows:
Client Hello
The client hello occurs when the client sends a request to the server to communicate. The TLS version, the cipher suites
supported, and a string of random bytes known as the “client random” are included in the hello.
Server Hello
In the server hello, the server acknowledges the client hello. It then ensures it is using a TLS version that is
compatible with the client TLS version, selects a compatible cipher suite from the ones offered by the client, and sends
its certificate, the server random (similar to the client random), and the public key to the client.
Certificate Validation
The validity of the server’s certificate is first checked by the client through the certificate authority. The certificate authority, or CA, is a
highly trusted entity given the responsibility of signing and generating digital certificates.
Pre-Master String
The client then encrypts a random string of bytes, called the “Pre-Master String” with the server’s public key and sends
it back to the server. This ensures that only the server can decrypt the key with its own private key, acting as another
level of security.
Session Key Creation
The server decrypts the pre-master key, and then both the client and server create session keys from the client random,
the server random, and the premaster string.
Finished Messaging
The client and server then send each other messages saying they have finished creating their keys, and they compare keys
with each other. If the session keys match, the TLS Handshake is completed, and the session keys are used to encrypt and
decrypt any data sent between the server and client.
Once created, certificates can be used for authentication of servers, clients, or other devices. Certificates are considered valid for a certain time period, and expire after that time frame. Certificates follow a constant lifecycle which include phases such as creation, renewal, suspension, expiration, and more. If certificates are left to expire, then the certificate holder will no longer be trusted, resulting in a loss of service for the website or device being used. To receive a certificate, a user or website must first go through a certificate authority or sign one themselves.
Certificate Authorities
Certificates can be generated through either a trusted certificate authority or by signing a certificate themselves. Certificate authorities, or CAs, generate certificates for users to be used for TLS/SSL authentication. To ensure a certificate authority can be trusted, the chain of trust of the CA can be followed back to the source CA. A chain of trust is a chain of certificates published by trusted CAs, leading all the way back to the Root CA. To start the process of acquiring a digital certificate, the requestor must send out a Certificate Signing Request (CSR) to the CA. The CSR must have the public key of a key pair created by the requestor, along with information to confirm the identity of the requestor, such as a social security number or driver’s license. Once the requestors identity has been confirmed, the certificate is signed and returned by the CA and can be used for identification of the requestor.
The other option to get a certificate is to create one yourself using the same information, and then to self-sign it. This is used less often, because the identity of the signer cannot be verified with other trusted CAs, thus rendering the self-signed certificate suspicious. Due to this, many will not accept a self-signed certificate, so using a CA to create a certificate is the suggested method.
Certificate Lifecycle
There are several distinct stages to the certificate lifecycle, which are shown below.
Discovery
Discovery is the first stage of the certificate lifecycle. In the discovery phase, the network is scanned for
missing,
expired, or unusable certificates. This phase also ensures any certificates already in place have been deployed
properly. Certificates with vulnerabilities and other weaknesses can also be detected and fixed or replaced. The
different certificates are commonly inventoried together in this phase to allow for tracking of certificate
statuses, or
grouping of related certificate types.
Creation/Purchasing
In this stage the CA creates the certificate itself, or the user purchases a certificate from a trusted CA. The
key pair
for the certificate is created and the public key, CSR, and personally identifiable information are sent to the CA
for
certificate creation. If an organization or user does not have or does not wish to create a chain of trusted CAs,
a
certificate is purchased instead of being created.
Installation
This stage deals with the distribution and installation of the certificate in its proper place. All aspects of
the
certificate’s configuration are checked in the installation phase, including the key pairs, the cipher suites, and
the
digital signature. The certificate is then installed onto the appropriate endpoint it was created for, and begins
authentication of that endpoint.
Storing
One of the most important stages of the certificate lifecycle is the storing phase. Certificates must be
accessible, but
not reusable by attackers, thus they must be kept in a secure and centralized location. The storing phase can also
inventory the certificates into groups, if inventorying was not done in the discovery phase.
Monitoring
This is the longest phase, where the certificates are monitored throughout the duration of their expiration
period. Once
the expiration date is reached, or sometimes right before, certain certificate management systems will
automatically
renew certificates. If automatic certificate management systems are not being used, then a system administrator
will
need to monitor the network’s certificates and renew, revoke, or replace any certificate that reaches its
expiration
date.
There are benefits to both manual and automatic monitoring, which will be discussed in-depth in the next section,
but
there are two important benefits which stand above the rest. The biggest benefit of manual monitoring is that if
an
unexpected issue occurs, then the monitor can react in real time to the problem, whereas an automatic system will
not
know what to do. On the other hand, an automatic monitor’s biggest benefit is that certificate renewals,
revocations,
etc. will not be forgotten, which can occur if a human is monitoring certificates for years.
Renewal
The renewal process of certificates begins once the validity of the certificate has run out. Once the user or
automated
systems decide to renew the certificate, a CSR is resent to the original issuing CA to get the certificate
renewed. The
process occurs as it did with originally creating the certificate, but much more quickly.
Revocation
If the issuing CA has be decommissioned, a certificate is being misused, or for a host of other reasons, then a
certificate can be revoked. Once revoked, the certificate is placed on a Certificate Revocation List, or CRL, if a
CRL
is in use. A CRL is a list of certificates revoked by the CA that should no longer be trusted. If an Issuing CA’s
certificate is on a CRL, then that CA cannot be used in a chain of trust for other CAs or certificates. A downside
to
using CRLs is that revoked certificates are only published periodically, not every time a certificate is revoked.
This
issue means a user could renew their certificate with their issuing CA, even though a few hours ago their
certificate
was revoked for illegitimate usage.
Replacement
If a CA’s certificate is revoked or if the certificate owner wishes to move from paid certificates to their own
Public
Key Infrastructure, then the replacement phase occurs. This occurs less often, as it is easier to just renew a
certificate with the original issuing CA.
The certificate lifecycle is not set in stone. Different organizations will have different stages, combine
stages, or
leave out entire stages entirely. As long as the certificates are discovered, created, stored, monitored, and
renewed,
then that is considered a certificate lifecycle.
Manual vs Automated Infrastructure
One of the most important parts of a company’s data security policy is the certificate management infrastructure put into place within the organization. A manual infrastructure involves having an employee create a spreadsheet to keep track of validity periods, policies, revocations, and configuration data of all the certificates within the organization. This method will work with a smaller company with an infrastructure only dealing with a few certificates, but many larger companies can have thousands upon thousands of certificates, making manual infrastructures too complicated. The other option is to create an automated certificate lifecycle infrastructure, which is the more common method. Below is a table highlighting the differences between manual and automated certificate management infrastructures.
Manual Infrastructure
Automated Infrastructure
Lifecycle Stages
Handled via a spreadsheet and a user keeping track of all the certificates within the organization
Streamlined and handled automatically; Certificates renewed/replaced/revoked as soon as necessary
Operational Cost
Costs many man hours
Less cost and no man hours needed
Security
Must be constantly kept track of by the employee in charge to ensure certificates do not expire
Is constantly watched by the software set up in the infrastructure, allowing for quick renewal or replacement of certificates
Implementation
Easy and quick to implement; Only a spreadsheet is required
The software must be implemented correctly, or certificates will not be monitored correctly
These reasons, and more, are why automated certificate lifecycle management systems are used in Public Key Infrastructures.
The Importance of Certificate Management
One of the most important reasons to have a strong, automated certificate management system is if you have your own Public Key Infrastructure (PKI). A PKI is an infrastructure created to authenticate users based on digital certificates. PKIs can encrypt communications as well. The most common PKI is TLS/SSL, which uses both symmetric and asymmetric encryption in securing connections between two users. The core trust of a PKI comes from the certificates traded between the two sides of the connection. Most PKIs use a two layer architecture, which includes a Root CA and an Issuing CA.
Root CA is a certificate authority that is kept offline and creates a certificate for the online Issuing CA. This creates a chain of trust with all certificates issued by the Issuing CA, as the Root CA is kept offline so it is therefore secure from malicious intent. Issuing CAs distribute certificates for end users and devices. The less commonly used three tier architecture for a PKI includes an Intermediate CA between the Root and Issuing CA, which act as a go between for the Root and Issuing CA. The reason automated certificate management is mainly used by PKIs is because it is more secure to create a PKI correctly once and then let the automated services keep the certificates up to date. This cuts down on the cost to the company, the man hours required to keep the PKI running, and human error. Since so many organizations are creating their own PKI, proper certificate management is key to any company’s security plan.
Another reason that so much importance is put onto certificate management is the need for every device and user that is connected to the Internet to have a digital certificate. Whenever a user or a device connects to a website, the authenticity of their digital certificate is checked, along with the certificate of the website. By having a strong chain of trust and a valid certificate, you can go anywhere on the Internet. However, a certificate is invalid or expired, if the user or device that certificate belongs to cannot go to most websites, as a secure connection cannot be established. The same holds true for website certificates. If their digital certificate is invalid, then users will not or cannot use that website, for fear of getting malware or viruses on their device.
One more reason to ensure strong certificate management is so that breaches do not occur in an organization. If a certificate were to be allowed into a network, even though it has untrusted CAs in its chain of trust, then the owner of that certificate could steal sensitive data or otherwise misuse company data for malicious purposes. Also, if the certificates are not stored properly, then an attacker could steal that certificate and pose as a legitimate user, while stealing, changing, or deleting sensitive data.
Other Certificate Uses
There are a number of other uses for digital certificates, which are listed below.
Intranet Portals
Ecommerce websites
VPNs
Point of Sales System
Internet of Things Devices
App Development
Code Signing
Email Signing
SSH Key Management
Financial Services
Customer Service Websites
Cloud Authentication
Certificate Management with Encryption Consulting
Encryption Consulting provides a variety of services relating to certificate management. We offer PKI assessments,CP/CPS development for PKIs, and PKI Design and Implementation services. Our PKI assessment will assess the current certificate management practices of our customer and help with the development of a strategy and roadmap for certificate management. Our CP/CPS development and PKI design and implementation services provide assistance in creating and implementing all the stages of a PKI, from on-premises to the cloud. We can provide our services via video or in person, at the customer’s behest. We also provide services to help develop and implement certificate management systems into new and current infrastructure.
To most people, the term ‘encryption‘ goes hand-in-hand with PKI, and rightfully so. PKI, or more commonly, SSL/TLS certificates and keys, have been in use for over two decades, securing channels of communication by providing end-to-end encryption of data-in-transit. Enterprises have typically employed x.509 certificates across their entire IT infrastructure to protect information belonging to them, and more importantly, their customers. The fact remains that the value of a robust, leak-proof PKI system cannot be understated. After all, history has demonstrated that a single certificate going offline can snowball into literally costing a firm millions of dollars.
Back to the present – the phenomenon of digital transformation is in full bloom, and manual processes are continuously being automated across the board. This means more devices and virtual services are being added to networks – these are endpoints that have to be protected by installing certificates on them. More importantly, x.509 certificates are not a fit-and-forget solution. Once a certificate is installed on, say, a server, it has to be continuously monitored for issues, renewed when its validity expires, and replaced with a new one. Here’s a quick rundown of the activities a PKI expert might have to perform while managing the life cycle of a certificate:
As is apparent, managing certificates using manual processes is not a simple task. Several teams follow a manual, ticket-based approach to certificate management, which works on an ad-hoc basis. While the obvious problem with manual management is the fact that handling thousands of certificates can be awfully error-prone, unreliable, and time-consuming, there are also some hidden downsides:
Inefficient Policy and Audit Mechanisms: A lack of granular control over who modifies or generates certificates/keys does not allow for reliable audit tracking or homogenous policy enforcement across the network.
Clouded visibility: Building on the former pain-point, siloed processes severely limit visibility into trust structures, which could lead to far too many certificates going undocumented. This makes it painful to locate and maintain a certificate in order to prevent its unexpected expiry.
Insecure private key storage: Holding private keys in unsecured locations (plain text documents, as opposed to HSMs, for instance) opens up an enterprise to possibilities of data theft or breaches by means of man-in-the-middle attacks. The human element involved in manual management is also a constant risk factor.
These downsides are usually circumvented by implementing structured certificate management processes from day 1, and ensuring that all ops teams are equipped with ample visibility and control over their PKI. Automate the manual processes to remove the margin of error, and you’ve got yourself a foolproof security infrastructure to handle your encryption needs.
And in order to do that, you’d do well in following some industry-standard best practices. The official ones are detailed in the NCCoE-published guide on the NIST recommendations for TLS certificate management. However, if you’d like a quick, distilled summary of the de-facto mandated principles to be followed while managing TLS certificates, here are our top 5 best practices for certificate management, in no particular order:
Obtain Visibility
Ensure that you always have a handle on every certificate in your inventory. This entails periodically scanning the network to identify CA-issued certificates and mapping them to the endpoints they’re installed on. While this also greatly simplifies future certificate ops, it also helps administrators weed out orphaned, expired, or otherwise insecure certificates.
Ideally, subnet scans must be performed to located certificates and host names. Care must be taken to perform well-controlled scans by batching the subnet list and implementing cooling periods between scans, so as to avoid network load. Hint: Schedule scans overnight or during periods of low network traffic for the best results!
Maintain Inventory
It doesn’t stop with scanning! Care must be taken to ensure that the results of the scan are stored, or updated in your existing inventory. Categorization of discovered certificates plays a major role in simplifying operations. For instance, you may choose to group certificates based on whether they’re used in test, or production environments.
You may also want to group them based on owner hierarchy to simplify tracking and alert escalation. Finally, ensuring that policy is implemented uniformly across groups is imperative, but we’ll get to that.
Enforce Policy
While organizational policies might already be in place, as mandated by NIST, what you require is a means by which policy can be enforced via automation. For example, you may choose to define renewal mechanisms for certificates to be automatically renewed when they are past 80% of their validity periods. Such rule-definition capabilities for policy enforcement enable you to quickly recover from potential disasters.
For ex: If you have contracts in place with backup CAs, and mechanisms to automatically implement a bulk replacement, you hedge yourself against the risk factor of a CA compromise.
Protect Private Keys
Regardless of the method used to store private keys (HSMs, software vaults, keystores, or even files), your #1 priority should lie in removing the human element from the key management exercise. When you prevent individuals from having direct access to private keys, you eliminate the possibility of theft, and make it simpler to track down potential compromise. This state of automated key orchestration is achieved by leveraging automation workflows to push certificates and their keys to network endpoints. And when key access is absolutely necessary, a role-based, privileged approach must be followed.
That said, additional layers of security never hurt anyone. Instruct your teams to make conscious efforts to encrypt keys at rest, and protect critical data by means of instruments adhering to the FIPS 140-2 standard.
Enable End-to-end Monitoring
Despite having a fully automated certificate management process, PKI infrastructures have to be constantly monitored for weak links. What you need is a system that ties into every aspect of your certificates across multiple CAs and network security/automation software. Dashboards that track expiry and redundancy are incredibly handy, as are notifications sent to certificate owners prior to expiry.
Another way to drill down on the monitoring/maintenance cycle is to schedule reports on the status of certificate groups that reach only their owner(s). This serves the purpose of keeping teams informed on statuses, as well as eliminating noise.
As a security stakeholder or a member of a Sec/Net/DevOps team that deals with TLS certificates and keys, it would be in your best interest to ensure that your organization adheres to these guidelines, if you haven’t done so already. As they say, better safe than sorry – every single certificate may be that one weak link in an otherwise solid security setup. Preventing certificate outages is a lot simpler than dealing with them afterward. Good luck!
If you need assistance with setting up and managing your PKI, feel free to reach out to us at www.encryptionconsulting.com, and to learn more about implementing full-fledged, scalable certificate lifecycle automation systems within your organization, visit appviewx.com.
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies.
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
Cookie
Duration
Description
cookielawinfo-checkbox-analytics
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional
11 months
The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy
11 months
The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
