I made a web server / microservices thing that issues certs for clients from a CA root it automatically generates. Then internal reverse proxy connections use that cert so the whole path is TLD encrypted with full cert validation.
Running one’s own root Certificate Authority in 2023
161–164 of 164 posts
Re: Running one’s own root Certificate Authority in 2023
#162Earlier quoted context omitted.
> People conflate the two and then try to charge $50 for the $0.0000001 use-case Then… don’t buy certificates? Use letsencrypt or run your own CA? There are tons of options out there.
You can't use Let's Encrypt for private DNS zones in the general case. "Running your own CA" like it's a big ceremony is precisely what I'm saying ought not to be necessary. Do you "run" your own random password generation service PaaS with custom Kubernetes controllers and everything? That's what someone else suggested, and not in jest!
But it's not really that much work. Disclaimer, I'm the author: 1) https://gruchalski.com/posts/2020-09-07-certificate-authorit..., 2) https://gruchalski.com/posts/2021-03-28-firebuild-rootfs-grp.... There are many options for various levels of entry.
Re: Running one’s own root Certificate Authority in 2023
#163Earlier quoted context omitted.
It’s about damn time that we should be able to get intermediate signing certs that are domain limited from a public ca and issue out own “real” certs. This is fully supported in the standards. Anyone offering this product affordably yet?
Domain limiting is implemented using x.509 cert nameConstraints, which the last time I've checked were not supported on Apple devices.. Edit: has been fixed in osx 10.13.3. Idk about iOS.
macOS 10.13.3 was released in January 2018, well over five years ago. Can we please stop repeating the "can't use it, it's not supported" line?
Re: Running one’s own root Certificate Authority in 2023
#164Earlier quoted context omitted.
The main advantage is that this CA and all downstream certificates would be globally-trusted (limited to the domain), which is not the case for a custom CA. Security-wise it shouldn't be any worse than wildcard certificates which are already a thing. It would actually improve things, because the user can now issue downstream certificates much more granularly without having to interact with the root CA (so you can iss…
It would improve things for everybody but the certificate authorities. They're selling something with a marginal cost of zero for $50 each. A wildcard certificate costs more not because it is materially different or "harder" to issue, but because it replaces many $50 certificates. Thus, it "must" cost more, or everybody would just use wildcard certificates everywhere and reduce profits at the large public CAs. It is…
LetsEncrypt already destroyed that "$50 ceremony for $0 cost" business model.