My apologies, I didn’t word my concerns properly in the moment. I would like to run a private CA simply because I do not want to use a public domain for my internal network. It makes me deeply uncomfortable to use a public domain and get public certificates for something inherently so private (it’s more philosophical than technical, although I suppose that’s where a lot of opinionated technical decisions come from anyway). Your solution is elegant and simple, but I really do want to do it completely internally, and move towards zero trust security practices as I do. Basically, I want to start training myself on the security side of SRE in my lab, running services which matter to me and working like the more paranoid SRE teams in corporations work…I know this sounds like fantasy, and my needs might change going forward, but I’m also hoping to learn a lot from this and hopefully make this as robust as I can. Having a good security posture makes me feel warm inside :)