Recommendations: Internal Certificate Authority w/ CRL and/or OCSP
from teddypolice@feddit.org to selfhosted@lemmy.world on 25 Jan 11:55
https://feddit.org/post/7202089

Title says it - I want a simple CA that doesn’t overcomplicate things (looking at you, EJBCA). I need it to serve at least CRLs or better OCSP automatically for the certs it manages. If it comes with a Web GUI, all the better, but doesn’t need to. Docker deployment would be sweet.

Currently handling this on an OPNSense I happen to be running, but that thing is also serving stuff to the public 'net, so I’d rather not have my crown jewels on there.

#selfhosted

threaded - newest

theit8514@lemmy.world on 25 Jan 12:15 next collapse

Sadly, most of the ones I’ve found are too complicated, and getting all devices to accept the CA is more hassle than it’s worth for self hosting. I’ve given up and just buy my wildcard cert for 60$/yr and just put it on everything.

gray@pawb.social on 25 Jan 15:02 next collapse

fyi you can get a wildcard from letsencrypt for free

teddypolice@feddit.org on 26 Jan 11:31 collapse

I’m a trained netsec professional so handling keys and such is not really a hassle for me. What is a hassle IMO is having to manually do more things than hitting the “revoke” button to fully properly revoke a certificate, so that’s where the CRL/OCSP req comes from.

Looks like that part is something you really only get for free with EJBCA, which I’ve tried and found very exhausting to use for my home network. If I had to pick one for work I’d probably go with EJBCA though, seems worth the effort if you’re doing more complex things.

ptz@dubvee.org on 25 Jan 12:33 next collapse

smallstep.com/docs/step-ca/index.html

There’s basically two executables involved:

  • step is the CLI app used to request certificates
  • step-ca is the server process the step client connects to

I’ve got the CA portion bundled into Docker. It can also run as an ACME server (and is compatible with certbot).

johannes@lemmy.jhjacobs.nl on 25 Jan 16:20 next collapse

This is exactly what i wanted to say :)

teddypolice@feddit.org on 26 Jan 11:21 collapse

step-ca does not currently support active revocation mechanisms like a Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP).

Meh. Doesn’t do what I need it to. :/

Does seem like automatic CRL/OCSP is something you only get for free with EJBCA. Frustrating, that.

nitrolife@rekabu.ru on 25 Jan 14:09 next collapse

I think you search that: developer.hashicorp.com/vault/…/pki-engine

just_another_person@lemmy.world on 25 Jan 14:20 next collapse

This entire question has oxymorons all over it, but…

  • EasyRSA - simple and well-known CLI implementation that is used almost everywhere for OpenVPN
  • Step - newer on the block, but seems extremely well documented and fairly well used
  • XCA - old-school, but still actively developed. May not even work on more modern machines
False@lemmy.world on 25 Jan 15:46 next collapse

If overcomplicating things is a concern for you, then just use let’s encrypt. Running your own ca is a pain in the ass and probably decreases security for most people due to the difficulty of doing it correctly.

Oisteink@feddit.nl on 27 Jan 19:29 collapse

Nobody needs ocsp or clr in their homelab. And if they’re a trained netsec professional they know that its far better with short-lived certs than any revocation model. Both zerossl and letsencrypt are easy to use - and works flawlessly with something like caddy on a wildcard domain, or an acme proxy. Openssl is easy, and you can clr with that or even use their ocsp for homelab.