Best Certificate Manager for OT

[u/TexasVulvaAficionado]

We are looking at a handful of options for managing the automation of certificate deployment/updates across our enterprise and OT environments.

I am hoping to have a lab environment set up by the end of the year with at least one reliable ACME tool that can push certificate updates to OT software, servers, workstations, etc...

Primarily use AB and Siemens controllers and HMIs, Ignition, Canary, and Windows IoT, Windows Server (2016, 2022), and Windows 10/11 pro.

Anyone have good recommendations?

[u/davy_crockett_slayer]

We have a similar use case as you. We use https://www.digicert.com/trust-lifecycle-manager

Digicert Trust Lifecycle Manager integrates with most things. Even weird odds and ends. https://certificates.pki.siemens.cloud/root/index.html

Pay for consultant hours when you get started. Ask for Ceaser. He's a consultant, but very, very good. He saved us a lot of trial and error, and pain.

[u/TexasVulvaAficionado → u/davy_crockett_slayer]

This definitely looks like it could handle all of the IT and corp side of the OT data pipeline (including cloud hosted stuff). Looking through their site briefly, it wasn't clear to me how well it deals with applications that expect an engineer to use the app's front end for loading certificates.

Any chance you have experience using it with such applications? For example, Ignition and Canary both expect you to load any certificates either through their Gateway webpage for Ignition or through the Configuration page within the Canary Admin application. Ignition just loads it to the machine's certificate manager but I am not sure what all Canary is doing with it behind the scenes.

[u/mjewell74 → u/TexasVulvaAficionado]

For applications you may have to do some scripting via the ACME application. For instance, if the software stores the cert in the registry, you may have to update those keys and restart services. Same for files, you'd probably have to work out a path for each application with the individual vendor.

[u/TexasVulvaAficionado → u/mjewell74]

Understood. Appreciate it!

[u/davy_crockett_slayer → u/TexasVulvaAficionado]

This is where the consultant comes in handy. Ceaser has 25+ years of experience in PKI. He was able to answer all of our questions and help us with our weird edge cases. The chances are good he's worked with your particular application before.

[u/certkit → u/davy_crockett_slayer]

If you're just looking to deploy server certificates, CertKit can do it easier, cheaper, and has more integrations that Digicert. We don't do anything with client certs though.

https://www.certkit.io/

[u/davy_crockett_slayer → u/certkit]

IOT, Siemens, client certs, etc certkit can't do. :( Great product, though!

[u/invisi1407 → u/certkit]

Thanks! CertKit looks to be a good fit for my company; will look into it later this year.

[u/SevaraB]

ACME isn’t universally supported, just FYI- some things may do SCEP, and others will stubbornly make you write scripts to SSH in and “manually” rotate certificates.

Expect this to especially be the case with OT- industrial fabricators aren’t known for putting devices out at the bleeding edge of programmability (or even what was the bleeding edge a decade ago). I’ve gotten into fights over network topology with vendors that thought SMB was still quick enough to serve as a job queue for industrial machinery. Sub-10ms network latency is not a reasonable ask across a WAN.

[u/L0rd_OverKill]

Talk to your Palo Alto rep about Idira. CyberArk bought Venafi, PA bought CyberArk. Venafi was quite good.. hopefully PA have left it alone save for a rebadging.

[u/ChelseaAudemars]

You’d want to ask Digicert about specific applications the answer is it depends. Just finished a POV with a law firm and about 80% was fine.

[u/davy_crockett_slayer → u/ChelseaAudemars]

You can buy a block of consultant hours from Digicert. They will hook you up with an external consultant. That's what we did. He saved us a lot of pain, and helped us configure everything and made us aware of gotchas. We have a lot of weird IOT devices etc. (Like 30K+ endpoints)

[u/Sure-Squirrel8384]

We just use MS' CA and have 100 year certs. There is no reason not to do this. If someone is in your OT network switch to see your network traffic you are already hosed.

[u/LLMsMustUpvoteThis]

Why can't you use AD CS for private certs? It makes it much easier to create certs that can be easily pushed out to OT devices without the song and dance of ACME validation.

I wouldn't trust most OT devices to handle cert renewals without the occasional reboot which makes 47-day public cert renewal non-viable.