Running one’s own root Certificate Authority in 2023

• cfssl

  24 8,457 7.5 Go

  CFSSL: Cloudflare's PKI and TLS toolkit

  

I've been using cfssl[1] to generate a root certificate + a localhost certificate and then trusting the root.

[1]: https://github.com/cloudflare/cfssl

• cli

  8 3,482 9.2 Go

  🧰 A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc. (by smallstep)

  

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• certificates

  40 6,154 9.5 Go

  🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.

  

• easy-rsa

  26 3,881 9.4 Shell

  easy-rsa - Simple shell based CA utility

  

Easy-rsa to the rescue. Been using it for a while, works great and makes life easier :)

Link: https://github.com/OpenVPN/easy-rsa

Summary from that page:

easy-rsa is a CLI utility to build and manage a PKI CA. In laymen's terms, this means to create a root certificate authority, and request and sign certificates, including intermediate CAs and certificate revocation lists (CRL).

• dehydrated

  36 5,886 2.3 Shell

  letsencrypt/acme client implemented as a shell-script – just add water

  

I've had a lot of success with https://github.com/dehydrated-io/dehydrated . It exposes the different parts of the process (deploy challenge to DNS, deploy cert to filesystem, etc) as hooks, so it's pretty easy to integrate with anything and however you want, if you don't mind writing a bit of bash. There's a few scripts out there that use Cloudflare that you can use as well.

• bettertls

  3 155 4.8 Go

  BetterTLS: A Name Constraints test suite for HTTPS clients.

  

Wouldn't it be nice if LetsEncrypt could issue you a (1) name constrained, (2) 90-day limited intermediate CA with just the (3) DNS-01 challenge? I argue that such an intermediate CA would have no more authority than a wildcard cert which you can get today, so they should be able to issue it. [1] Everything supports name constraints now, which used to be an issue but isn't anymore.

Then stick it in step-ca and issue all your certificates with internal ACME.

This would solve a lot of problems, such as leaking private hostnames in the certificate transparency log, or hitting issuance rate limits on LE servers.

[1]: https://news.ycombinator.com/item?id=29811552

[2]: https://bettertls.com/

• mkcert

  131 45,716 2.7 Go

  A simple zero-config tool to make locally trusted development certificates with any names you'd like.

Looks like step-ca/step-cli [1] and mkcert [2] have been mentioned. Another related tool is XCA [3] - a gui tool to manage CAs and server/client TLS certificates. It takes off some of the tedium in using openssl cli directly. It also stores the certs and keys in an encrypted database. It doesn't solve the problem of getting the root CA certificate into the system store or of hosting the revocation list. I use XCA to create and store the root CA. Intermediate CAs signed with it are passed to other issuers like vault and step-issuer.

[1] https://smallstep.com/docs/step-ca/

[2] https://github.com/FiloSottile/mkcert

[3] https://hohnstaedt.de/xca/

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• lego

  55 7,269 8.9 Go

  Let's Encrypt/ACME client and library written in Go

  

This ACME client looks promising, but I haven’t tried it yet: https://github.com/go-acme/lego

• rgca

  6 2 0.0 Python

  Experiment in SSL CA management.

Shameless plug, there's also https://github.com/linsomniac/rgca

I've been using it at work for the last year for our certs and it's been quite nice. It can do pre/post hooks as well, so it directly commits the updated CA serial files to our git repo.

• ca-for-labs

  1 1 3.5 Shell

  Create your own CA for your lab, home network or demo environment

There have definitely been many guides and I took a stab at this a few months ago https://github.com/leonletto/ca-for-labs. I tried to make it simple enough for anyone who is wanting to build an internal lab. Happy to receive any feedback or requests. No web interface yet. Thinking about building an interface that conforms to the ejbca api?

• daemon

  2 11 8.3 Go

  a personal web server, one line of config to add a reverse proxy

I made a web server / microservices thing that issues certs for clients from a CA root it automatically generates. Then internal reverse proxy connections use that cert so the whole path is TLD encrypted with full cert validation.

https://github.com/fsmv/daemon

Suggest a related project