Certificate and key renewals become dangerous when nobody owns the inventory. These 20 practices help a Linux and UNIX administration team track expirations, protect keys and renew certificates before they interrupt the business.

  1. Inventory every certificate and key, including its expiration date and renewal period. Put the inventory in a database as soon as possible.
  2. Choose certificate management software that fits your requirements, such as HashiCorp Vault, Venafi Trust Protection Platform or DigiCert CertCentral.
  3. Configure the certificate management software and connect it to your infrastructure and applications.
  4. Create a workflow for requesting, approving and renewing certificates and keys.
  5. Store every certificate and key securely with the encryption controls provided by the software.
  6. Use the software API or CLI with Ansible, Chef or Puppet to automate certificate and key deployment across the infrastructure.
  7. Create a directory service such as LDAP or Active Directory for certificate and key records, then connect it to the management software.
  8. Use role-based access control (RBAC) to limit certificate and key access by role and permission.
  9. Use the software's hardware security module (HSM) integrations to protect keys.
  10. Use the certificate authorities (CAs) supplied by the software to issue and manage certificates and keys.
  11. Use Transport Layer Security (TLS) to protect network traffic and certificates and keys in transit.
  12. Monitor certificate transparency logs for unexpected issuance and unauthorized certificates.
  13. Use the software's certificate monitoring tools to track expiration and issuance.
  14. Use certificate validation tools to check SSL/TLS certificate validity and security.
  15. Use a reverse proxy such as Nginx or Apache with the management software for SSL/TLS termination and certificate management.
  16. Use the software's Let's Encrypt integration to obtain free SSL/TLS certificates and automate renewal.
  17. Use certificate revocation lists (CRLs) or the Online Certificate Status Protocol (OCSP) to revoke certificates.
  18. Use certificate pinning so clients trust only the specific certificates and keys you approve.
  19. Run the software's automation on a regular schedule to monitor and update the certificate inventory.
  20. Use the software's security features for regular security audits and penetration tests of the certificate and key management system.

Original publication on GoDaddy