Isn't this the industry expectation in that kind of equipment? If it was signed by a real CA the cert. could expire and render the equipment unable to communicate.

▲

peterabbitcook a day ago | parent | next [-]

That’s a tough question. If your PLC is on an airgapped LAN, admin/admin is not great security hygiene but you’ve reduced most of the risk by airgapping.

On my project the service I wrote was doing bidirectional communication with the PLC over OPCUA. The server running this pod was connected to the internet, so it was critical to have proper TLS for the OPCUA client/server. Rotating LetsEncrypt certs on the system every 45 days is a lot of toil, but using a self-signed cert that expires in 2040 from some dev laptop doesn’t pass muster in most organizations either.

That’s just the OPCUA path.. In these projects You also typically see WinCC HMIs that can talk to the PLC from anywhere on the network without TLS. And also SIMATIC Web Server pages - minimally secured by default, and the amount of info you can grok about the system in Chrome Dev Tools is troubling.

▲

gopher_space a day ago | parent | next [-]

> admin/admin is not great security hygiene but you’ve reduced most of the risk by airgapping.

admin/admin is on a post-it stuck to the monitor because everyone we hire is perfectly capable of rooting a machine they have physical access to.

	▲	crote a day ago \| parent [-]
		Yeah, but deliberately rooting a machine you have no business touching means you are instantly getting fired. Having an actual password prevents people "borrowing" a key to the equipment broom closet from "optimizing" some config values they really shouldn't be messing around with.

▲

sidewndr46 a day ago | parent | prev | next [-]

I'm not sure if you're speaking from personal experience, but most I've interacted with don't have to worry about the self-signed vs. LetsEncrypt debate. They just don't do it. Also there would be no way to do LetsEncrypt as the system is air gapped.

▲

bragr a day ago | parent [-]

You can do DNS challenges for air gapped networks as long as the TXT records resolve publicly.

	▲	sidewndr46 a day ago \| parent [-]
		So then you have a signed CSR right? How would you get the certificate onto the box?

▲

detourdog a day ago | parent | prev | next [-]

Just my opinion but I believe a self-signed is more secure than Let’s encrypt. When a self-signed cert changes and no one in the org knows why that is alarming. Getting certificate error messages every month and half every numbs the org to the alarm.

▲

dylan604 a day ago | parent | prev [-]

> Rotating LetsEncrypt certs on the system every 45 days is a lot of toil

What is unique about your system using LetsEncrypt that you can't automate certbot to handle this task as it was designed and intended to be done?

	▲	gmueckl a day ago \| parent \| next [-]
		On an airgapped system that is is turned on once and needs to keep running for many, many years? Industrial equipment is a world of its own and internet best practices just don't transfer directly. Some PLCs run extremely expensive machines. Some machines can't afford to have their control systems stutter or fail because that can lead to physical damage and production outages of enormous proportions. A PLC that stops communicating because a certificate just expired is absolutely not acceptable in some plants.
	▲	tgsovlerkhgsel a day ago \| parent \| prev [-]
		Running certbot on your web server is easy. Running certbot on a random PLC isn't happening.

▲

tgsovlerkhgsel a day ago | parent | prev | next [-]

My guess would be something like the CA using some feature that was newer than what the equipment would support (e.g. ECC signatures but the equipment only supporting RSA), not an intentional "no real CAs" decision.

▲

stephbook a day ago | parent | prev [-]

also you can't pin the user/pw to the machine with a note, because someone might need remote access. better stick with admin/admin