Certificate Manager Business Continuity

Certificate Manager Business Continuity คืออะไร

Certificate Manager คือระบบจัดการ digital certificates (SSL/TLS, code signing, client certificates) ขององค์กร Business Continuity คือแผนรับมือเพื่อให้ธุรกิจดำเนินต่อได้เมื่อเกิดเหตุฉุกเฉิน เมื่อรวมสองแนวคิดนี้ Certificate Manager Business Continuity หมายถึงการวางแผนสำรองและกู้คืนระบบจัดการ certificates เพื่อป้องกัน certificate expiration outages, CA failures และ key compromises ที่อาจทำให้เว็บไซต์ล่ม API ใช้งานไม่ได้ หรือ services สื่อสารกันไม่ได้

Certificate Lifecycle Management

# cert_lifecycle.py — Certificate lifecycle management
import json
from datetime import datetime, timedelta

class CertLifecycle:
    PHASES = {
        "request": {
            "phase": "1. Request / Generation",
            "actions": ["สร้าง CSR (Certificate Signing Request)", "กำหนด SAN (Subject Alternative Names)", "เลือก key algorithm (RSA 2048+, ECDSA P-256)"],
        },
        "issuance": {
            "phase": "2. Issuance",
            "actions": ["ส่ง CSR ไป CA (Certificate Authority)", "Domain validation (DV) / Organization validation (OV)", "รับ certificate + chain"],
        },
        "deployment": {
            "phase": "3. Deployment",
            "actions": ["ติดตั้งบน web server / load balancer", "Configure TLS settings", "Test SSL (ssllabs.com)"],
        },
        "monitoring": {
            "phase": "4. Monitoring",
            "actions": ["ตรวจ expiration date", "Alert 30/14/7 วันก่อนหมดอายุ", "Monitor CT logs (Certificate Transparency)"],
        },
        "renewal": {
            "phase": "5. Renewal / Rotation",
            "actions": ["Auto-renew (ACME/Let's Encrypt)", "Manual renewal สำหรับ OV/EV", "Deploy new certificate"],
        },
        "revocation": {
            "phase": "6. Revocation",
            "actions": ["Revoke เมื่อ key compromised", "Update CRL / OCSP", "Issue replacement certificate"],
        },
    }

    CERT_TYPES = {
        "dv": {"name": "DV (Domain Validation)", "validation": "Domain ownership", "time": "นาที", "cost": "ฟรี-ถูก", "use": "เว็บทั่วไป, APIs"},
        "ov": {"name": "OV (Organization Validation)", "validation": "Organization identity", "time": "1-3 วัน", "cost": "ปานกลาง", "use": "Corporate, e-commerce"},
        "ev": {"name": "EV (Extended Validation)", "validation": "Full org verification", "time": "1-2 สัปดาห์", "cost": "แพง", "use": "Banking, government"},
        "wildcard": {"name": "Wildcard (*.domain.com)", "validation": "DV/OV", "time": "ตาม type", "cost": "ปานกลาง-แพง", "use": "Multi-subdomain"},
    }

    def show_phases(self):
        print("=== Certificate Lifecycle ===\n")
        for key, phase in self.PHASES.items():
            print(f"[{phase['phase']}]")
            for action in phase["actions"][:2]:
                print(f"  • {action}")
            print()

    def show_types(self):
        print("=== Certificate Types ===")
        for key, ct in self.CERT_TYPES.items():
            print(f"  [{ct['name']}] {ct['validation']} | {ct['cost']} | {ct['use']}")

lifecycle = CertLifecycle()
lifecycle.show_phases()
lifecycle.show_types()

Business Continuity Plan

# bcp.py — Certificate business continuity plan
import json

class CertBCP:
    RISKS = {
        "cert_expiry": {
            "risk": "Certificate หมดอายุโดยไม่รู้ตัว",
            "impact": "เว็บไซต์แสดง SSL error, users ไม่สามารถเข้าถึง",
            "probability": "สูง (เกิดบ่อยมาก)",
            "mitigation": "Auto-renewal (ACME), monitoring alerts, cert inventory",
        },
        "ca_failure": {
            "risk": "CA (Certificate Authority) ล่มหรือถูก revoke",
            "impact": "ไม่สามารถ issue/renew certificates",
            "probability": "ต่ำ",
            "mitigation": "ใช้หลาย CAs, backup certificates จาก CA อื่น",
        },
        "key_compromise": {
            "risk": "Private key ถูกขโมย",
            "impact": "Attacker สามารถ impersonate server, MitM attacks",
            "probability": "ปานกลาง",
            "mitigation": "HSM storage, key rotation, certificate pinning, revocation plan",
        },
        "automation_failure": {
            "risk": "ACME auto-renewal ล้มเหลว",
            "impact": "Certificate expire → service outage",
            "probability": "ปานกลาง",
            "mitigation": "Monitoring, fallback manual renewal, multiple ACME clients",
        },
    }

    PLAN_TEMPLATE = {
        "prevention": [
            "Certificate inventory: ทุก cert, expiry date, owner, CA",
            "Auto-renewal: ACME/certbot สำหรับ DV certs",
            "Monitoring: alert 30/14/7/1 วันก่อนหมดอายุ",
            "Multi-CA strategy: Let's Encrypt + ZeroSSL + commercial",
            "Key management: HSM หรือ encrypted storage",
        ],
        "response": [
            "Emergency cert issuance procedure (< 1 hour)",
            "CA failover: switch to backup CA",
            "Key compromise: revoke + re-issue + deploy within 4 hours",
            "Communication plan: notify affected teams/customers",
        ],
        "recovery": [
            "Restore cert from backup",
            "Deploy to all servers/load balancers",
            "Verify SSL configuration",
            "Update monitoring",
        ],
    }

    def show_risks(self):
        print("=== Risk Assessment ===\n")
        for key, risk in self.RISKS.items():
            print(f"[{risk['risk']}]")
            print(f"  Impact: {risk['impact']}")
            print(f"  Mitigation: {risk['mitigation']}")
            print()

    def show_plan(self):
        print("=== BCP Template ===\n")
        for phase, items in self.PLAN_TEMPLATE.items():
            print(f"[{phase.upper()}]")
            for item in items[:3]:
                print(f"  □ {item}")
            print()

bcp = CertBCP()
bcp.show_risks()
bcp.show_plan()

Automation with ACME & certbot

# automation.py — Certificate automation
import json

class CertAutomation:
    CERTBOT = """
# certbot — Let's Encrypt automation

# Install
sudo apt install certbot python3-certbot-nginx -y

# Issue certificate (Nginx)
sudo certbot --nginx -d example.com -d www.example.com

# Issue certificate (standalone)
sudo certbot certonly --standalone -d example.com

# Auto-renewal (cron)
echo "0 3 * * * certbot renew --quiet --deploy-hook 'systemctl reload nginx'" | sudo crontab -

# Test renewal
sudo certbot renew --dry-run

# Certificate locations
# /etc/letsencrypt/live/example.com/fullchain.pem
# /etc/letsencrypt/live/example.com/privkey.pem
"""

    ACME_PYTHON = """
# acme_monitor.py — Certificate monitoring script
import ssl
import socket
from datetime import datetime

def check_cert_expiry(hostname, port=443):
    context = ssl.create_default_context()
    with socket.create_connection((hostname, port), timeout=10) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            cert = ssock.getpeercert()
            expires = datetime.strptime(cert['notAfter'], '%b %d %H:%M:%S %Y %Z')
            days_left = (expires - datetime.now()).days
            
            return {
                'hostname': hostname,
                'issuer': dict(x[0] for x in cert['issuer']),
                'expires': expires.isoformat(),
                'days_left': days_left,
                'status': 'OK' if days_left > 30 else 'WARN' if days_left > 7 else 'CRITICAL',
            }

# Check multiple domains
domains = ['example.com', 'api.example.com', 'app.example.com']
for domain in domains:
    try:
        result = check_cert_expiry(domain)
        print(f"[{result['status']:>8}] {domain}: {result['days_left']} days left")
    except Exception as e:
        print(f"[   ERROR] {domain}: {e}")
"""

    CERT_MANAGER_K8S = """
# cert-manager on Kubernetes
helm repo add jetstack https://charts.jetstack.io
helm install cert-manager jetstack/cert-manager \\
  --namespace cert-manager --create-namespace \\
  --set installCRDs=true

# ClusterIssuer for Let's Encrypt
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx
"""

    def show_certbot(self):
        print("=== Certbot Setup ===")
        print(self.CERTBOT[:400])

    def show_python(self):
        print(f"\n=== Python Monitor ===")
        print(self.ACME_PYTHON[:500])

    def show_k8s(self):
        print(f"\n=== cert-manager (K8s) ===")
        print(self.CERT_MANAGER_K8S[:400])

auto = CertAutomation()
auto.show_certbot()
auto.show_python()
auto.show_k8s()

Certificate Inventory

# inventory.py — Certificate inventory management
import json
import random
from datetime import datetime, timedelta

class CertInventory:
    def generate_inventory(self):
        print("=== Certificate Inventory ===\n")
        certs = [
            {"domain": "example.com", "type": "DV", "ca": "Let's Encrypt", "days": random.randint(10, 80), "auto": True},
            {"domain": "*.example.com", "type": "Wildcard OV", "ca": "DigiCert", "days": random.randint(30, 300), "auto": False},
            {"domain": "api.example.com", "type": "DV", "ca": "Let's Encrypt", "days": random.randint(5, 85), "auto": True},
            {"domain": "internal.corp.com", "type": "Internal CA", "ca": "Corp CA", "days": random.randint(60, 365), "auto": False},
            {"domain": "payment.example.com", "type": "EV", "ca": "Sectigo", "days": random.randint(100, 365), "auto": False},
        ]
        for cert in certs:
            status = "OK" if cert["days"] > 30 else "WARN" if cert["days"] > 7 else "CRIT"
            auto = "Auto" if cert["auto"] else "Manual"
            print(f"  [{status:>4}] {cert['domain']:<25} {cert['type']:<12} {cert['ca']:<15} {cert['days']:>3}d {auto}")

    def alerts(self):
        print(f"\n=== Expiry Alerts ===")
        alerts = [
            {"level": "CRITICAL", "msg": "api.example.com expires in 5 days!"},
            {"level": "WARNING", "msg": "*.example.com expires in 28 days"},
            {"level": "INFO", "msg": "3 certificates renewed successfully today"},
        ]
        for a in alerts:
            print(f"  [{a['level']:>8}] {a['msg']}")

inv = CertInventory()
inv.generate_inventory()
inv.alerts()

Disaster Recovery

# dr.py — Certificate disaster recovery
import json

class CertDR:
    SCENARIOS = {
        "mass_expiry": {
            "scenario": "หลาย certificates หมดอายุพร้อมกัน",
            "rto": "< 2 hours",
            "steps": [
                "1. ใช้ certbot renew --force-renewal สำหรับ ACME certs",
                "2. Manual issue สำหรับ OV/EV certs (contact CA)",
                "3. Deploy ทีละ service ตาม priority",
                "4. Verify SSL ทุก domain",
            ],
        },
        "key_leak": {
            "scenario": "Private key ถูกเผยแพร่",
            "rto": "< 1 hour",
            "steps": [
                "1. Revoke certificate ทันที (CA portal / ACME)",
                "2. Generate new key pair",
                "3. Issue new certificate",
                "4. Deploy + verify",
                "5. Investigate root cause",
            ],
        },
        "ca_outage": {
            "scenario": "CA ล่ม ไม่สามารถ issue/renew",
            "rto": "< 4 hours",
            "steps": [
                "1. Switch to backup CA",
                "2. Issue new certs จาก backup CA",
                "3. Update ACME config",
                "4. Monitor ว่า primary CA กลับมาเมื่อไหร่",
            ],
        },
    }

    def show_scenarios(self):
        print("=== DR Scenarios ===\n")
        for key, scenario in self.SCENARIOS.items():
            print(f"[{scenario['scenario']}] RTO: {scenario['rto']}")
            for step in scenario["steps"][:3]:
                print(f"  {step}")
            print()

    def backup_checklist(self):
        print("=== Backup Checklist ===")
        items = [
            "Certificate inventory (domain, CA, expiry, owner)",
            "Private keys (encrypted, HSM or vault)",
            "CA account credentials (ACME accounts)",
            "DNS credentials (for DNS-01 validation)",
            "Deployment scripts/playbooks",
            "Emergency contacts (CA support, team leads)",
        ]
        for item in items:
            print(f"  □ {item}")

dr = CertDR()
dr.show_scenarios()
dr.backup_checklist()

FAQ - คำถามที่พบบ่อย

Q: Let's Encrypt เพียงพอสำหรับ production ไหม?

A: เพียงพอสำหรับ DV certificates (เว็บทั่วไป, APIs) ข้อจำกัด: ไม่มี OV/EV, หมดอายุทุก 90 วัน (ต้อง auto-renew), rate limits แนะนำ: ใช้ Let's Encrypt + certbot สำหรับ DV ใช้ commercial CA สำหรับ OV/EV (banking, enterprise)

Q: Certificate หมดอายุเกิดบ่อยไหม?

A: บ่อยมาก เป็นสาเหตุ #1 ของ SSL outages แม้แต่บริษัทใหญ่: Microsoft, Google, Equifax เคยเจอ สาเหตุ: ลืม renew, automation failure, no monitoring ป้องกัน: auto-renewal, monitoring alerts, certificate inventory

Q: cert-manager บน Kubernetes ดีไหม?

A: ดีมาก Auto-issue และ auto-renew certificates สำหรับ Ingress รองรับ Let's Encrypt, Vault, self-signed, custom CAs Integration กับ Ingress controllers (Nginx, Traefik) เป็น standard สำหรับ K8s TLS management

Q: Private key เก็บที่ไหนดี?

A: Best: HSM (Hardware Security Module) — AWS CloudHSM, Azure HSM Good: Secret manager — HashiCorp Vault, AWS Secrets Manager OK: Encrypted file — SOPS, sealed-secrets ห้าม: plaintext บน disk, Git, shared drives