Setting up a trusted, self-signed SSL/TLS certificate authority in Linux

1. mkcert

   1 143 53,138 1.9 Go

   A simple zero-config tool to make locally trusted development certificates with any names you'd like.

   

   Interesting, just checked out if mkcert (the popular way of doing this) supports it and found two issues:

   https://github.com/FiloSottile/mkcert/issues/131

   https://github.com/FiloSottile/mkcert/pull/113

   Hopefully Filippo revisits this now that it's broadly supported.

2. InfluxDB

   influxdata.com featured

   InfluxDB high-performance time series database. Collect, organize, and act on massive volumes of high-resolution data to power real-time intelligent systems.

   

3. cli

   2 9 3,835 9.4 Go

   🧰 A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc. (by smallstep)

   

   I previously used openssl-based scripts to generate certificates to use for local development or applications on a private network. I have since moved to using the step CLI [1].

   OpenSSL is powerful, but it's hard to figure out how to use correctly. Each command seems cryptic no matter how many times I use it.

   The step CLI is a lot simpler, even though it has a few quirks: generating PKCS1 formatted private keys instead of the newer PKCS7 format, making every leaf certificate eligible to be either a server certificate or a client certificate, and absurdly low default certificate expirations.

   1: https://github.com/smallstep/cli

4. Caddy

   3 434 63,585 9.4 Go

   Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

   

   https://github.com/caddyserver/caddy/issues/5759 :

   > When generating a CA cert via caddy and putting that in the trust store, those private keys can also forge certificates for any other domain.

   RFC5280 (2008) "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile" > Section 4.2.1.10

5. internal-contstrained-pki

   4 2 543 3.2 Shell

   Safely shareable TLS root CA for .internal networks using Name Constraints

   

   See this for a simple CA tutorial script including Name Constraints using only OpenSSL:

   https://github.com/nh2/internal-contstrained-pki

6. easy-rsa

   5 27 4,191 9.4 Shell

   easy-rsa - Simple shell based CA utility

   

7. bettertls

   6 5 168 3.1 Go

   BetterTLS: A Name Constraints test suite for HTTPS clients.

   

   It says "Proposed Standard" on the RFC; maybe that's why it's not widely implemented if that's the case?

   https://bettertls.com/ > Name Constraints & Archived results doesn't seem to have recent versions of SSL clients listed?

     nameConstraints=critical,

Suggest a related project