<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>Hello,</div>
<div> </div>
<div>Back-linking to my related stack overflow post so i can centralize responses.</div>
<div> </div>
<div>stackoverflow.com/questions/56360728/unattended-automated-linux-device-key-management-certs-for-accessing-update-ser</div>
<div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="margin:0 0 10px 0;"><b>Sent:</b> Tuesday, May 28, 2019 at 3:49 PM<br/>
<b>From:</b> "Hunter Nins" <Hunter90960@mail.com><br/>
<b>To:</b> openstack-discuss@lists.openstack.org<br/>
<b>Subject:</b> [barbican] dev: Using Barbican for media box/center unattended cert, key (KEK) updates, etc.</div>
<div name="quoted-content">Hello,<br/>
<br/>
Pardon: the first attempt was html-formatted.<br/>
<br/>
I am currently working on a customized media center/box product for my employer. It's basically a Raspberry Pi 3b+ running Raspian, configured to auto-update periodically via `apt`. The device accesses binaries for proprietary applications via a private, secured `apt` repo, using a pre-installed certificate on the device.<br/>
<br/>
Right now, the certificate on the device is set to never expire, but going forward, we'd like to configure the certificate to expire every 4 months. We also plan to deploy a unique certificate per device we ship, so the certs can be revoked if the tamper mechanism is triggered (i.e. if the customer rips open the box, it blows a fuse that is attached to a ADC chip, and the device reports in s/w that the sensor has been tripped). Finally, we anticipate some customers leaving the device offline, and only updating once every year (allowing for time for the cert to expire).<br/>
<br/>
Is there a way I could use Barbican to:<br/>
* Update the certs for apt-repo access on the device periodically.<br/>
* Setup key-encryption-keys (KEK) on the device, if we need the device to be able to download sensitive data, such as an in-memory cached copy of customer info.<br/>
* Provide a mechanism for a new key to be deployed on the device if the currently-used key has expired (i.e. the user hasn't connected the device to the internet for more than 4 months).<br/>
* Allow keys to be tracked, revoked, and de-commissioned.<br/>
<br/>
Thank you for your time and assistance.<br/>
</div>
</div>
</div>
</div></div></body></html>