3 ms·
XCA (https://hohnstaedt.de/xca/ https://hohnstaedt.de/xca/) is another way to manage a small CA, though it doesn't have ACME.
by RedShift1 6y ago
XCA (https://hohnstaedt.de/xca/ https://hohnstaedt.de/xca/) is another way to manage a small CA, though it doesn't have ACME.
- rad_gruchalski 6y agoThere is hashicorp vault pki, square certstrap, cloudflare’s cfssl... but none comes with acme.
- tialaramex 6y agoIn one sense this is actually what you want. The whole point of ACME is to facilitate proof of control. For the Web PKI this is mandatory, certificate automation without proof of control wouldn't really be deployable. In a local environment you likely don't need that, and may even not have a way to do it even if you wanted to. So ACME's secret sauce is irrelevant. Any of the older protocols that just do certificate issuance with no proof of control, like SCEP, would be fine. But because ACME has been so successful (good!) lots of newer or updated software incorporates ACME support out of the box, and so it is attractive to be able to interface to that support. We could have had a situation where most server software did SCEP and you needed an adaptor to reflect the SCEP requests into a system that would use ACME to get them a certificate if they face the public Internet. But that isn't what we got, so, fine, this works, I'll take it.