This is not really an Apple thing, it's an industry trend (and a good one IMO). Apple's generally applying the same criteria Chrome is:
https://chromium.googlesource.com/chromium/src/+/HEAD/net/do...
Running one’s own root Certificate Authority in 2023
11–20 of 164 posts
Re: Running one’s own root Certificate Authority in 2023
#12Doesn't the first Apple link specifically say the 398-day limit doesn't apply to self-signed CAs?
> This change will affect only TLS server certificates issued from the Root CAs preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS.
> This change will not affect certificates issued from user-added or administrator-added Root CAs.
The second link about the other restrictions (including <=825 days validity) does appear to apply to all CAs.
Re: Running one’s own root Certificate Authority in 2023
#13Actually running a CA, even if only for private purposes, without certain regret down the road involves more than creating an OpenSSL cnf file, creating a root cert/key, and running with it. That said, it's a starting point. If you're looking to use more modern (i.e., faster) crypto than RSA keys, maybe check out my sping on a CSR generator wrapping `openssl`, available at https://johannes.truschnigg.info/code/tls_req_gen
If you need a self-signed cert instead, maybe try https://johannes.truschnigg.info/code/tls_cert_gen
Re: Running one’s own root Certificate Authority in 2023
#14Doesn't the first Apple link specifically say the 398-day limit doesn't apply to self-signed CAs? > This change will affect only TLS server certificates issued from the Root CAs preinstalled with iOS, iPadOS, macOS, watchOS, and tvOS. > This change will not affect certificates issued from user-added or administrator-added Root CAs. The second link about the other restrictions (including <=825 days validity) does appe…
And yet, my homegrown root CA cert with 3650 days of validity hums along just fine...
[edited: but since I also want to have host certs that are on various internal servers, the short validity applies to them]
Re: Running one’s own root Certificate Authority in 2023
#15I went with DNS based Let's Encrypt for internal certificates, since I'm okay leaking my internal DNS names. > An obvious downside of this is having to guard a bunch of secrets and the need to rotate the host certificates yearly – because Apple says so. The guarding secrets thing makes me too uncomfortable with managing my own CA. I'm sure it'd be fine, but since there are other equivalent and safer ways to do it.. N…
I used to have my own local root CA as well but now trying the Let's Encrypt with DNS-01. What is the easiest combination of software to try it? I have failed miserably trying Opnsense + ACME client plugin + Cloudflare DNS + HAProxy / NGinx. I would get 100% ssllabs certs but somehow the reverse proxy won't forward to internal services. Next I am gonna go caddyserver for reverse proxy as it has SSL with LE inbuilt. L…
do you use https/have a cert in your webserver as well, or just on the proxy?
Re: Running one’s own root Certificate Authority in 2023
#16Re: Running one’s own root Certificate Authority in 2023
#17I really like step[1] and step-ca[2] for this, it's a lot less fiddly than having to drive OpenSSL directly.
Re: Running one’s own root Certificate Authority in 2023
#18I run a squid proxy with TLS intercept on a raspberry pi, with my own CA.
I have things set up so that the RPi connects to a WiFi, and then a cable from the RPi goes to another WiFi router.
I connect my MacBook Pro to that other router.
This way the MacBook Pro cannot reach the internet.
Then I set the http and https proxy configs in Firefox so that it goes via the squid on the RPi. And I have the root CA from the RPi trusted in Firefox.
Additionally I have set some env variables and added my root CA cert to some cert storages on the computer, so that git can clone via squid, and I can install and update things with brew etc.
It works great :D
But then I tried to set up my iPhone to also connect to that WiFi. I think I managed to trust my root CA on the phone. But I couldn’t manage to set up the http/https proxy on the iPhone and so for now only the MacBook Pro can use it, and not the iPhone
Re: Running one’s own root Certificate Authority in 2023
#19Earlier quoted context omitted.
The one thing you can’t do with Let’s Encrypt is generate a certificate with a CN of localhost which, since browsers are getting really picky about mixed HTTP/HTTPS content, is a real issue with local development using certain web features.
I’ve also struggled with this. Is there an elegant solution that you’re aware of? Everything I’ve tried feels really rickety.
I've been using cfssl[1] to generate a root certificate + a localhost certificate and then trusting the root.
Re: Running one’s own root Certificate Authority in 2023
#20I really like step[1] and step-ca[2] for this, it's a lot less fiddly than having to drive OpenSSL directly. 1. https://github.com/smallstep/cli 2. https://github.com/smallstep/certificates
That's really neat, thanks for the pointer. ;)