I developed "LessEncrypt" for my dev environment, an ultra lightweight, hassle free alternative to LetsEncrypt for use with self-signed CAs like in a dev or homelab environment. At work we have self signed keys for our dev/stg environment, and manage it with Ansible and some scripts, but spend a surprising amount of time dealing with it. This is an experiment to get us out of that business.
https://github.com/linsomniac/lessencrypt
Short description:
- Client generates RSA keypair and connects to server from <1024 TCP port, sends pubkey.
- Server uses reverse DNS to come up with cert name (rules can specify alternate CN and SANs, override TTL, etc).
- Server generates a signed cert and connects back to client on <1024 TCP port and sends cert.