Running one’s own root Certificate Authority in 2023
1–10 of 164 posts
Re: Running one’s own root Certificate Authority in 2023
#2I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names.
> An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so.
The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. Name constraints are a thing in the spec for restricting your CA to specific domains (which is amazing,) but browser/etc support was crappy when I looked at it and maybe getting better? I don't understand why name constraints aren't implemented everywhere. Unless an enterprise environment is doing TLS inspection, name constraints are a way saner implementation.
Re: Running one’s own root Certificate Authority in 2023
#3I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…
Did you use elliptic curve instead of RSA?
Re: Running one’s own root Certificate Authority in 2023
#4I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…
The one thing you can’t do with Let’s Encrypt is generate a certificate with a CN of localhost which, since browsers are getting really picky about mixed HTTP/HTTPS content, is a real issue with local development using certain web features.
Re: Running one’s own root Certificate Authority in 2023
#5I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…
The one thing you can’t do with Let’s Encrypt is generate a certificate with a CN of localhost which, since browsers are getting really picky about mixed HTTP/HTTPS content, is a real issue with local development using certain web features.
I’ve also struggled with this. Is there an elegant solution that you’re aware of? Everything I’ve tried feels really rickety.
Re: Running one’s own root Certificate Authority in 2023
#6I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…
> I don't understand why name constraints aren't implemented everywhere.
They have weird semantics, especially in scenarios with multiple prospective validation paths: path `EE -> ICA' -> ICA'' -> TA` might result in different name constraints than `EE -> ICA' -> ICA''' -> TA`, resulting in hard-to-debug validation errors (or successes) depending on the user's trust store state.
(I don't believe that's why Chrome doesn't support them, however. Chrome's stated reason[1] is that they don't support them on user roots because RFC 5280 doesn't require them to, which is IMO a correct reading of the spec.)
[1]: https://bugs.chromium.org/p/chromium/issues/detail?id=107208...
Re: Running one’s own root Certificate Authority in 2023
#7Earlier quoted context omitted.
The one thing you can’t do with Let’s Encrypt is generate a certificate with a CN of localhost which, since browsers are getting really picky about mixed HTTP/HTTPS content, is a real issue with local development using certain web features.
I’ve also struggled with this. Is there an elegant solution that you’re aware of? Everything I’ve tried feels really rickety.
For localhost, there’s not much downside to a self-signed cert.
Re: Running one’s own root Certificate Authority in 2023
#8I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…
I used to have my own local root CA as well but now trying the Let's Encrypt with DNS-01. What is the easiest combination of software to try it? I have failed miserably trying Opnsense + ACME client plugin + Cloudflare DNS + HAProxy / NGinx. I would get 100% ssllabs certs but somehow the reverse proxy won't forward to internal services. Next I am gonna go caddyserver for reverse proxy as it has SSL with LE inbuilt. Let's see.
Re: Running one’s own root Certificate Authority in 2023
#9I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…
The one thing you can’t do with Let’s Encrypt is generate a certificate with a CN of localhost which, since browsers are getting really picky about mixed HTTP/HTTPS content, is a real issue with local development using certain web features.
You also can't generate a cert for a double wildcard, like mydomain . com . * . * Or an entire domain, although I'm unsure if that is possible with your own CA as well
Re: Running one’s own root Certificate Authority in 2023
#10I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…
I used to have my own local root CA as well but now trying the Let's Encrypt with DNS-01. What is the easiest combination of software to try it? I have failed miserably trying Opnsense + ACME client plugin + Cloudflare DNS + HAProxy / NGinx. I would get 100% ssllabs certs but somehow the reverse proxy won't forward to internal services. Next I am gonna go caddyserver for reverse proxy as it has SSL with LE inbuilt. L…
A friend of mine runs dns01 thusly: https://ipng.ch/s/articles/2023/03/24/lego-dns01.html