Running one’s own root Certificate Authority in 2023

1. cfssl

   1 24 8,867 5.6 Go

   CFSSL: Cloudflare's PKI and TLS toolkit

   

   I've been using cfssl[1] to generate a root certificate + a localhost certificate and then trusting the root.

   [1]: https://github.com/cloudflare/cfssl

2. SaaSHub

   www.saashub.com featured

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

3. cli

   2 8 3,732 9.3 Go

   🧰 A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc. (by smallstep)

   

4. certificates

   3 42 6,957 9.6 Go

   🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.

   

5. easy-rsa

   4 26 4,124 9.6 Shell

   easy-rsa - Simple shell based CA utility

   

   Easy-rsa to the rescue. Been using it for a while, works great and makes life easier :)

   Link: https://github.com/OpenVPN/easy-rsa

   Summary from that page:

   easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's terms, this means to create a root certificate authority, and request and sign certificates, including intermediate CAs and certificate revocation lists (CRL).

6. dehydrated

   5 36 6,000 1.3 Shell

   letsencrypt/acme client implemented as a shell-script – just add water

   

   I've had a lot of success with https://github.com/dehydrated-io/dehydrated . It exposes the different parts of the process (deploy challenge to DNS, deploy cert to filesystem, etc) as hooks, so it's pretty easy to integrate with anything and however you want, if you don't mind writing a bit of bash. There's a few scripts out there that use Cloudflare that you can use as well.

7. bettertls

   6 4 167 3.1 Go

   BetterTLS: A Name Constraints test suite for HTTPS clients.

   

   Wouldn't it be nice if LetsEncrypt could issue you a (1) name constrained, (2) 90-day limited intermediate CA with just the (3) DNS-01 challenge? I argue that such an intermediate CA would have no more authority than a wildcard cert which you can get today, so they should be able to issue it. [1] Everything supports name constraints now, which used to be an issue but isn't anymore.

   Then stick it in step-ca and issue all your certificates with internal ACME.

   This would solve a lot of problems, such as leaking private hostnames in the certificate transparency log, or hitting issuance rate limits on LE servers.

   [1]: https://news.ycombinator.com/item?id=29811552

   [2]: https://bettertls.com/

8. mkcert

   7 140 51,780 1.9 Go

   A simple zero-config tool to make locally trusted development certificates with any names you'd like.

   

   Looks like step-ca/step-cli [1] and mkcert [2] have been mentioned. Another related tool is XCA [3] - a gui tool to manage CAs and server/client TLS certificates. It takes off some of the tedium in using openssl cli directly. It also stores the certs and keys in an encrypted database. It doesn't solve the problem of getting the root CA certificate into the system store or of hosting the revocation list. I use XCA to create and store the root CA. Intermediate CAs signed with it are passed to other issuers like vault and step-issuer.

   [1] https://smallstep.com/docs/step-ca/

   [2] https://github.com/FiloSottile/mkcert

   [3] https://hohnstaedt.de/xca/

9. lego

   8 57 8,189 9.3 Go

   Let's Encrypt/ACME client and library written in Go

   

   This ACME client looks promising, but I haven’t tried it yet: https://github.com/go-acme/lego

10. rgca

    9 6 3 0.0 Python

    Experiment in SSL CA management.

    Shameless plug, there's also https://github.com/linsomniac/rgca

    I've been using it at work for the last year for our certs and it's been quite nice. It can do pre/post hooks as well, so it directly commits the updated CA serial files to our git repo.

11. ca-for-labs

    10 1 1 3.5 Shell

    Create your own CA for your lab, home network or demo environment

    There have definitely been many guides and I took a stab at this a few months ago https://github.com/leonletto/ca-for-labs. I tried to make it simple enough for anyone who is wanting to build an internal lab. Happy to receive any feedback or requests. No web interface yet. Thinking about building an interface that conforms to the ejbca api?

12. daemon

    11 2 11 8.0 Go

    a personal web server, one line of config to add a reverse proxy (by fsmv)

    

    I made a web server / microservices thing that issues certs for clients from a CA root it automatically generates. Then internal reverse proxy connections use that cert so the whole path is TLD encrypted with full cert validation.

    https://github.com/fsmv/daemon

Suggest a related project