Hi, I was looking at private CAs since I don’t want to pay for a domain to use in my homelab.

What is everyone using for their private CA? I’ve been looking at plain OpenSSL with some automation scripts but would like more ideas. Also, if you have multiple reverse-proxy instances, how do you distribute domain-specific signed certificates to them? I’m not planning to use a wildcard, and would like to rotate certificates often.

Thanks!

Edit: thank you for everyone who commented! I would like to say that I recognise the technical difficulty in getting such a setup working compared to a simple certbot setup to Let’s Encrypt, but it’s a personal choice that I have made.

  • deepdive@lemmy.worldEnglish
    12·
    10 months ago

    If you want to run your own pki with self-signed certificate in your homelab I really encourage you to read through this tutorial. There is a lot to process and read and it will take you some time to set everything up and understand every terminology but after that:

    • Own self-signed certificate with SAN wildcards (https://*.home.lab)
    • Certificate chain of trust
    • CSR with your own configuration
    • CRL and certificate revocation
    • X509 extensions

    After everything is in place, you can write your own script that revoks, write and generates your certificate, but that is another story !

    Put everything behind your reverse proxy of choice (traefik in my case) and serve all your docker services with your own self-signed wildcard certificates ! It’s complex but if you have spare time and are willing to learn something new, it’s worth the effort !

    Keep in mind to never expose such certificates on the wild wild west ! Keep those certificate in a closed homelab you access through a secure tunnel on your LAN !

    edit

    Always take notes, to keep track of what you did and how you solved some issues and always make some visuals to have a better understanding on how things work !

    • NeoNachtwaechter@lemmy.worldEnglish
      41·
      10 months ago

      never expose such certificates on the wild wild west ! Keep those certificate in a closed homelab you access through a secure tunnel on your LAN !

      I’m curious, what’s the reason?

      • jdrch@lemmy.worldEnglish
        2·
        9 months ago

        In many architectures in which certificates are used, a client with a valid certificate is a trusted client, so a certificate falling into the wrong hands is problematic.

    • MigratingtoLemmy@lemmy.worldOPEnglish
      1·
      9 months ago

      Thank you. Could you explain a bit more about your setup and the aspects I should be looking at? Specifically:

      • Certificate chain of trust: I assume you’re talking about PKI infrastructure and using root CAs + Derivative CAs? If yes, then I must note that I’m not planning to run derivative CAs because it’s just for my lab and I don’t need that much of infrastructure.
      • I have yet to figure out the CRL part with OpenSSL, I’ll have to read more about it. Thanks.
      • I do not know what X.509 extensions are and why I need them. Could you tell me more?
      • I’m also considering client certificates as an alternative to SSO, am I right in considering them this way? I will also have to think about what I could do what clients without a client certificate or my root CA’s certificate in their certificate store (maybe run another instance which doesn’t need all of the encryption and setup I’m doing and somehow redirect such clients there whilst logging their traffic?).

      Thanks for the mention, I was looking at a script to automate certificate generation and revocation too.

      Since we’re talking about reverse-proxies, I’ll mention that I plan to run an instance of HAProxy per podman pod so that I terminate my encrypted traffic inside the pod and exclusively route unencrypted traffic through local host inside the pod. I’m doing this because I do not want to see any unencrypted traffic in my network. Of course, this is some more overhead but I think this is doable. I got this idea from another post I made a while back. Of course, that means that every pod on my network (hosting an HAProxy instance) will be given a distinct subdomain, and I will be producing certificates for specific subdomains, instead of using a wildcard.

      Thanks, I’ll be sure to document my progress as I go.