cfssl VS minica

cfssl is kinda outright better version of that.

The Cloudflare SSL tools at https://github.com/cloudflare/cfssl might help. Here's what it shows for one of the example Snake Oil certs:

I've used this in the past and it worked great. https://github.com/cloudflare/cfssl

The first step is to create the source key that represents our user. This key is created using a tool like openssl but another popular tool to use is cfssl, created by Cloudflare. Some folks think cfssl is easier to use, and it definitely looks easier to script. But for this example we will use openssl. You can also choose to create the key using a number of different algorithms. For this example we will use ED25519.

TLS/SSL worked well with client certificates generated by the CFSSL API.

Not sure if relevant but we used tooling from CloudFlare in the past: https://github.com/cloudflare/cfssl

MiniCA[0] works for this, quite trivial to setup and stamp out certs.

[0] https://github.com/jsha/minica

I use minica (https://github.com/jsha/minica) for exactly that purpose. It’s a single binary that’s generating my Certificates easy enough.

I would personnally use minica if i had to manage a internal CA. But i don’t know if it can work with an intermediate certificate for signing.

I found minica very useful to do something like this (no affiliation): https://github.com/jsha/minica

https://github.com/jsha/minica can be quite handy for this as it can generate wildcard certs as well as a root

Other than that, there are some projects which help generating a self-signed chain with a root cert you could trust on the client machines. E.G. https://github.com/jsha/minica

Before to generate local certificates I used minica.

You could use something like https://github.com/jsha/minica if the fact that it's golang doesn't bother you 😉

If you’re just hosting locally and don’t feel like figuring out OpenSSL, easyRSA, etc etc, you can use minica to generate a wildcard cert signed by your own certificate authority. Then just add the root cert to all your devices and add the wildcard cert to any of the reverse proxies suggested on this post.

https://github.com/jsha/minica has been around longer and has met all my home lab needs so far. It's even plugged on LetsEncrypt-- https://letsencrypt.org/docs/certificates-for-localhost.