Device Certificate Best Practices Guide

[MattKing1]

This playbook provides guidance for issuing device certificates.

[lachellel]

Scope?

• Is there an existing guide this is intended to replace, or
• Is this specific to Non-Person / Device certificates issued from Agency internal certificate authorities
  • Less than medium hardware assurance certificates from an agency internal CA
  • No cross-boundary trust
• Will this include setup procedures and types of certificate profiles generally needed for devices and network security

[MattKing1]

Answers to LaChelle's questions:

1. No. There is no existing guide
2. No. This should be focused on guidance for device certificates issued under the FBCA or Common Device policy OIDs
3. I don't think we can include that level of detail, but perhaps we should discuss so I can get a better idea of your intent, since we may be able to provide some high level of direction.

[dasgituser]

Assigned to John Killian

[lachellel]

BTW - this doc is on idmanagement

• https://www.idmanagement.gov/IDM/servlet/fileField?entityId=ka0t0000000TNOEAA4&field=File__Body__s

I think it's OBE and would like to archive or repurpose any items as needed.

[weirdscience]

Comments from duplicate issue.

Some guidance here: https://https.cio.gov/certificates/ Though it touches on some topics beyond best practices for device certificates.

There are two different use cases:

1. Public Trust SSL
2. Network (intranet) devices which include many more endpoints and non-http protocols and devices
   So you're right eric - we should link to the https.cio.gov site for the web pki best practices as this also includes configuration best practices. For internal only locally trusted CAs, the only playbook we've put together is reusing one from DHS (that I send out / not posted) and a very short writeup for setting up a CA for domain controller certs (network auth).

Sounds like creating a page with pointers to where can get guidance or profile for device certs such as M-15-13, NIST 800-52, HTTPS CIO Memo and maybe NCCOE TLS project.

[idmken]

This document is deprecated.