I need some inputs for the scenario when the certificate expires which is stored
ID: 658954 • Letter: I
Question
I need some inputs for the scenario when the certificate expires which is stored on the embedded device on the network which is a client. Following is the explaination of the setup.
The setup explaination
1. A device (client) is connected on the internet.
2. We need to connect this device to the server
3. Currently the server is supporting the SSL protocol
4. We need to implement the SSL protocol on the device side
4. Device will send the data to the server
5. We can only access the server but not the device directly. Whatever data is received 6. by the server from the device can be viewed on the server only.
7. As stated in point no. 4, the data which is being flown between the server and the device should be made secured by using the SSL on the device side.
8. Device does not have a web browser facility.
So the device (client) has to have a root CA certificate stored in its keystore. When it expires how to renew it...
Explanation / Answer
If I understand you right the device will only communicate with a single or few specific servers. In this case you should not rely on the public CA system, but instead roll your own:
- If you have only a single server you can use a self-signed certificate and hard code the expected certificate in all devices (certificate pinning).
- If you have multiple servers you might either use multiple self-signed certificates and deposit them all in each device. Or you might create your own CA and store it as the only trusted CA on the device. Then accept anything signed by this CA but nothing else.
In both cases you control the expiration times of the certificates yourself, so you can make them really long or skip verification of expiration at the device. Of course you need to tightly protect the private keys of the generate certificates and CA, but this would be the same too if you use the public CA system.
And unless you are able to upgrade the firmware on the device you should use crypto algorithms which will likely be strong enough for the expected life time of the device. If you instead are able to update the firmware make sure the upgrade process is secure (e.g. signed upgrades) because otherwise an attacker might just add its own firmware and circumvent your SSL protection by grabbing the data on the device before they get encrypted with SSL.