4 ms·

The ACME protocol (used by Let's Encrypt / ZeroSSL) can be used with internal infrastructure, too. I know that some folks already use Let's Encrypt to issue int

The ACME protocol (used by Let's Encrypt / ZeroSSL) can be used with internal infrastructure, too. I know that some folks already use Let's Encrypt to issue internal TLS certificates, but that's not always ideal. Step CA[1] is an ACME v2-compliant, open source CA that supports all of the challenge types as Let's Encrypt / ZeroSSL. [1]: https://github.com/smallstep/certificates/ https://github.com/smallstep/certificates/

freedomben 6y ago
Nice, thanks for the tip! I've needed something like this a few times the last few months and knew there had to be something out there I was missing. This looks awesome.
tialaramex 6y ago
Note that this only really makes sense if you're using tooling that already came with ACME support, and so this drops in easily. I guess that's becoming pretty common though. Older tools might support technologies like SCEP but not ACME. These older protocols can't be used (on their own) to get certificates trusted in the Web PKI because the whole point of ACME is to do the proof-of-control step needed to get those certificates. But in your private PKI you likely don't need or even want that feature. I guess it can make sense for new software that is at least sometimes for public access to just do ACME, but it does feel like maybe Smallstep should have a legacy SCEP mechanism available. I see there is a GitHub ticket for that so no need to raise it again.
- Arnavion 6y ago
  These days private PKI probably uses EST instead of SCEP.
francislavoie 6y ago
Caddy actually ships with smallstep CA built in, and can act as an ACME server for mTLS. https://caddyserver.com/docs/caddyfile/directives/acme_server https://caddyserver.com/docs/caddyfile/directives/acme_serve... You can have Caddy instances that act as ACME clients to one that acts as the ACME server and load balancer. Read more about using it here: https://caddy.community/t/what-does-embedded-acme-server-do/8589/2 https://caddy.community/t/what-does-embedded-acme-server-do/...

freedomben 6y ago

Nice, thanks for the tip! I've needed something like this a few times the last few months and knew there had to be something out there I was missing. This looks awesome.

tialaramex 6y ago

Note that this only really makes sense if you're using tooling that already came with ACME support, and so this drops in easily. I guess that's becoming pretty common though. Older tools might support technologies like SCEP but not ACME. These older protocols can't be used (on their own) to get certificates trusted in the Web PKI because the whole point of ACME is to do the proof-of-control step needed to get those certificates. But in your private PKI you likely don't need or even want that feature. I guess it can make sense for new software that is at least sometimes for public access to just do ACME, but it does feel like maybe Smallstep should have a legacy SCEP mechanism available. I see there is a GitHub ticket for that so no need to raise it again.

Arnavion 6y ago
These days private PKI probably uses EST instead of SCEP.

francislavoie 6y ago

Caddy actually ships with smallstep CA built in, and can act as an ACME server for mTLS. https://caddyserver.com/docs/caddyfile/directives/acme_server https://caddyserver.com/docs/caddyfile/directives/acme_serve... You can have Caddy instances that act as ACME clients to one that acts as the ACME server and load balancer. Read more about using it here: https://caddy.community/t/what-does-embedded-acme-server-do/8589/2 https://caddy.community/t/what-does-embedded-acme-server-do/...