Chapter 31 — Cryptography and trust services: implementation II | Engineering Cryptography and trust services

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 31 — Cryptography and trust services: implementation II

Lesson map

Lesson 31 published. Map, example, EX091.

flowchart TD
  N0["Learning outcomes"]
  N1["31.1 Mutual TLS for collectors"]
  N2["31.2 Automating certificates"]
  N3["31.3 Configuration pitfalls"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX091"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["31.1 Mutual TLS for collectors"]
  N2["31.2 Automating certificates"]
  N3["31.3 Configuration pitfalls"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX091"]

[Learning outcomes]
    |
    v
[31.1 Mutual TLS for collectors]
    |
    v
[31.2 Automating certificates]
    |
    v
[31.3 Configuration pitfalls]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX091]

Learning outcomes

You will (1) deploy TLS 1.3 for collectors with mutual authentication; (2) automate certificate issuance and renewal; (3) avoid common TLS configuration errors.

31.1 Mutual TLS for collectors

Collectors connect to Ridgeway's gateway using TLS 1.3 from RFC 8446 with mutual authentication: the gateway presents its certificate and each collector presents a client certificate issued by Ridgeway's device authority. The gateway checks that the certificate chains to the device authority, has not expired and is not revoked, and maps its subject to a collector record. Aiyana configures the gateway to accept only TLS 1.3, removing older versions and their legacy cipher suites, which simplifies configuration and eliminates whole classes of downgrade problems.

31.2 Automating certificates

Collector certificates last ninety days and renew automatically through an internal ACME service, using the protocol from RFC 8555. Each collector generates its key pair locally, so the private key never leaves the device, and requests a certificate by proving control of its identity. Renewal starts when a third of the lifetime remains. Failed renewals raise alerts, following the lesson that automation can fail silently. Aiyana tests renewal by advancing a test collector's clock and confirming that it renews and that the gateway accepts the new certificate.

31.3 Configuration pitfalls

Aiyana lists TLS mistakes she checks for: disabling certificate verification in clients to get past an error; trusting the operating system's public roots for device certificates instead of only Ridgeway's authority; skipping hostname or identity checks; and using one certificate key across many collectors. She writes automated configuration tests that connect with an expired certificate, a certificate from another authority and a revoked certificate, and confirms each is rejected. These tests run whenever gateway configuration changes. A failing test blocks deployment until someone fixes the cause.

Worked example

Aiyana deploys TLS 1.3-only mutual authentication with ninety-day ACME certificates generated on device, and adds configuration tests for expired, foreign and revoked certificates.

Synthetic case. The device authority is invented; RFC 8446 and RFC 8555 are real.

Errors and limits

Mutual TLS adds certificate management burden; automation must be monitored. Trusting public roots for private device identity lets outsiders authenticate.

Exercises

EX091 — Mutual authentication. What does mutual TLS add for collectors? Rubric: 3 = collectors present client certificates from Ridgeway's device authority, checked by the gateway;; 2 = client cert;; 1 = encryption;; 0 = none.
EX092 — Key generation location. Where are collector private keys generated and why? Rubric: 3 = on the collector, so keys never leave the device;; 2 = locally;; 1 = central;; 0 = none.
EX093 — Root pitfall. Why not trust public roots for device certificates? Rubric: 3 = anyone with a public certificate could authenticate as a device; trust only Ridgeway's authority;; 2 = outsiders;; 1 = fine;; 0 = none.

Synthesis

Mutual TLS with automated, device-generated certificates and tested configurations secures collector links without manual toil.

Continue studying — chapter 31 of 50

← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →