> It is straightforward to create your own Root CA and use it to sign certificates for your private network, using openssl. I guess I'll be the one to say it:

> It is straightforward to create your own Root CA and use it to sign certificates for your private network, using openssl. I guess I'll be the one to say it: many people, myself included, get intimidated by using OpenSSL. The CLI has a bunch of different options and dealing with the inherent complexity of a PKI makes it all a bit of a mess: where you try to find the right invocations for whatever you need to do online and even then aren't sure whether everything is done correctly. At least that mirrors my own experience in the past and that of most folks I've talked to, both in private and prod projects. That's why I personally find software like Keystore Explorer actually decent for even things like running your own CA (probably for a small homelab, where you don't need automation): https://blog.kronis.dev/tutorials/lets-run-our-own-ca https://blog.kronis.dev/tutorials/lets-run-our-own-ca And yet, even then I don't have the confidence that I've done things the "right" way, frankly probably not. That's even before you get into things like staying on top of CVEs and keeping everything updated - overall staying safe is very challenging. There's probably also the need to configure a web server, like Apache with SSLCACertificateFile and just plenty of things to go wrong along the way, especially if you need mTLS as well. > Using this service means you really do not have a private network That's a fair point, though!