3 ms·
I've been doing this for a while with SmallStep CA: https://github.com/smallstep/certificates https://github.com/smallstep/certificates It's a bit of a pain to
by gclawes 2y ago
I've been doing this for a while with SmallStep CA: https://github.com/smallstep/certificates https://github.com/smallstep/certificates
It's a bit of a pain to load a cert onto every device (easier with stuff like Ansible if you have a bunch of linux devices), but manageable. And it lets me do proper trusted TLS for a lot of stuff that would otherwise be self-signed.
edit: It's also just a fun homelab project to see what it's like to run a full production-ish PKI setup.
One thing I recommend is to add X509v3 Name Constraints extensions to your root CA if you go down this path. It prevents the CA from being abused to MITM you for other domains (at least for browsers/clients that respect names constraints)
X509v3 Name Constraints: critical
Permitted:
DNS:home.arpa
DNS:.home.arpa
IP:10.0.0.0/255.0.0.0
IP:172.16.0.0/255.240.0.0
IP:192.168.0.0/255.255.0.0