Comment on Do you run a private CA? Could you tell me about your certificate setup if you do?
citizen@sh.itjust.works 6 months ago
I’m using step-ca. Its running on dedicated SBC. ACME certs created for each service renewing automatically daily. Honestly this setup wouldn’t be worth it if it wasn’t for daily cert rotation. I’m not using wildcard certs with own CA as it’s bad practice and defeats the purpose. I’m validating certs with DNS using TSIG. Step-ca have several integrations with different DNS services. I chose TSIG because it’s universal. There is pi-hole integration if you using that. Buying valid domain is not needed as long as you have internal DNS. You need to Install root Ca on every machine that will be connecting to services. If you have many VM’s configuration management is the way to go.
MigratingtoLemmy@lemmy.world 6 months ago
Thank you, and yes, I agree. Frequent certificate cycling and revocations is one of best parts of having a private CA, along with particular certificates for particular domains. With that said: Could you tell me more about TSIG? This is the first time I have come across it, and 2 seconds of reading tells me that it is used to validate automated updates and zone transfers for the DNS server, and also to validate domains? I didn’t think of this avenue before, but it seems very interesting to implement.
And yes, I will have an internal DNS, and I will be inserting the Root CA certificate on all of my client devices.