Hi, I was looking at private CAs since I don’t want to pay for a domain to use in my homelab.

What is everyone using for their private CA? I’ve been looking at plain OpenSSL with some automation scripts but would like more ideas. Also, if you have multiple reverse-proxy instances, how do you distribute domain-specific signed certificates to them? I’m not planning to use a wildcard, and would like to rotate certificates often.

Thanks!

Edit: thank you for everyone who commented! I would like to say that I recognise the technical difficulty in getting such a setup working compared to a simple certbot setup to Let’s Encrypt, but it’s a personal choice that I have made.

    • MigratingtoLemmy@lemmy.worldOPEnglish
      2·
      10 months ago

      Thanks, could you tell me why one would run this over plain OpenSSL with automation? Also, what risks would I run running a private CA? I’d love to know!

        • MigratingtoLemmy@lemmy.worldOPEnglish
          1·
          10 months ago

          I do realise the security problem in keeping the private key safe. I plan to use a VM with encrypted storage underneath. Do you think that’s OK for a homelab, or should I invest time into integrating HSM modules from Nitrokey?

            • MigratingtoLemmy@lemmy.worldOPEnglish
              1·
              10 months ago

              I would not like to use a public domain for my internal network. By extension, I do not want any public CA to know the domains and subdomains I use in my lab and home network

                • MigratingtoLemmy@lemmy.worldOPEnglish
                  2·
                  10 months ago

                  My apologies, I didn’t word my concerns properly in the moment. I would like to run a private CA simply because I do not want to use a public domain for my internal network. It makes me deeply uncomfortable to use a public domain and get public certificates for something inherently so private (it’s more philosophical than technical, although I suppose that’s where a lot of opinionated technical decisions come from anyway). Your solution is elegant and simple, but I really do want to do it completely internally, and move towards zero trust security practices as I do. Basically, I want to start training myself on the security side of SRE in my lab, running services which matter to me and working like the more paranoid SRE teams in corporations work…I know this sounds like fantasy, and my needs might change going forward, but I’m also hoping to learn a lot from this and hopefully make this as robust as I can. Having a good security posture makes me feel warm inside :)