1. You set up a private PKI using a private CA. AWS will sell you one for $400/month. Install the public root in the trust stores of the clients and then issue 5 year private certs for either IP addresses, or for .local and use DNS-SD.
2. You create a private domain at private.example.com. You get letsencrypt to issue a wildcard for .private.example.com. Then you set up private DNS for that zone. Server cert needs to be updated every 90 days. That involves downloading a single PEM file from your internal network.
Then it's just a matter of the devices connecting to the internet at least once a year and doing a very simple "Hey, I'm $device and using $address. Issue me a cert plz."
I'm no expert, but wouldn't that make GP's company effectively a delegate CA? This seems like it would need a very close relationship with the original CA - and all just for a simple web interface.
> include ip addresses in the SAN.
Not sure if this may be different with intermediate certs, but you won't find any public CA that will add private IP addresses as a SAN - as this would undermine the whole security model. If any CA did this, Chrome would likely ban them quickly.
I'm sceptical a CA would let you do that with intermediate certs if there is any danger the leaf certs get into the wrong hands (e.g. because the devices are sold, someone reverse-engeneers one and manages to talk to the back-end service)
Just going through the trouble of having the customer mess with their OS's DNS resolver to connect to the device is ludicrous. Can you even do it on Windows without having to deal with the hosts file manually?
Then they need to remember to update it when the IP inevitably changes because they've moved onto a new project with a different address plan, and they'll invariably forget to change it or forget how to do it or do it wrong and then call me to help them.
And on top of all that, no I can't really expect my devices to have internet access, not even once every 60 days. It's not uncommon for broadcast operations to use costly and critical satellite links for internet access, and they're not going to let random devices use that without a good reason. More generally, even if there's an internet connection available they're likely not to configure the gateway correctly, then complain when the night of the big event their browser refuses to connect to my equipment, saying that they're about to be h4x0r3d.
My use case is certainly a niche, but I think it's probably a significant niche given that everything and anything has web interfaces these days. Cameras have web interfaces for configuration, middle end smart switches and routers have web interfaces, I've even seen power plugs with web interfaces...