Subject: [Iotops] provisioning certificates for home routers

From: Michael Richardson <[email-masked]>
Date: Thu, 25 Feb 2021 10:51:05 -0500

In draft-richardson-homerouter-provisioning-00, titled:
   Provisioning Initial Device Identifiers into Home Routers

I have described the problem of providing HTTPS certificates to home routers
for their administrative interface.
This mechanism is being used today and has running code.

It could be used for devices other than home routers, and in particular could
be combined with the techniques that Ted Lemon describes in
   draft-lemon-stub-networks and draft-lemon-stub-networks-ps
   (note these documents got munged together, and the secretariat is sorting them)

My solution has some significant limitations, which I would like to discuss.
The major one has to do with the 90-day expiry for LetsEncrypt certificates.
This is ameliorated slightly with 13-month certificates, which is the
effective CABFORUM limit now.

The question is how long can we expect the device to remain in the box in a
warehouse?  If the device will have Internet after being plugged in the first
time, then an update could be possible using the expired certificate as a
step to get a renewed one.

For FTTH, CableModems, it is quite possible for the device to figure out
where the Internet is.  For installations involving VDSL, PPPoE then some
provisioning is often needed: still there is a trend for ISPs to provision a
generic login, and once that is used, to then use TR-069 to download a
per-customer login.

If this is to believed, then an update is entirely possible.

I have not filled in section 4 Protocol Details.  I'm actually not sure what
else to say.  Maybe I override section 3.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide