I have been playing around with trying to simplify the CLI-based self-signed CA use case, which started as a Memorial Day Weekend toy project. I have something

I have been playing around with trying to simplify the CLI-based self-signed CA use case, which started as a Memorial Day Weekend toy project. I have something working for the "new cert" case which replaces the old shell script that manages openssl.cnf files that no longer met our current use case (largely because it didn't support SANs). My experiment is basically: A config file, which can be overridden by the environment or CLI options, for the common certificate generation arguments. So the simple use case is: rgca cert new --san users.example.com www.example.com It can also run pre and post scripts to, say update your serial/index in git, and deploy keys to the server, say you are rekeying every 30 days... Interested in feedback. https://github.com/linsomniac/rgca https://github.com/linsomniac/rgca