FreeBSD as root/internal CA? reddit / freebsd ---------------------------------------------------------------------- scorc1 · 2022-11-22 21:10 Coming from the windows world, there is the root ca and intermediary ca that a windows sever can be setup as to issue root ca/sign cert reqs. How would I do similar with FreeBSD? Does the concept apply in FreeBSD? Just the open-ssl package? Google keeps replying with 'install root CAs in freebsd' or 'use ca- root-nss'. which do not appear to be what I am looking for (both are installing already made certs; id like to issue certs to internal infrastructure and then apply the trust to related systems). Using FreeBSD 13/13.1/current Edit: im not *trying* to use open-ssl. I just don't know what else to use. I'm **looking** for other options, or to define that it is the only option. ---------------------------------------------------------------------- rykolepl · 2022-11-22 21:41 You can do it with openssl but it'll be painfull, as openssl is hard to work with unless you know it very well. You can use something like xca to do it (gui app, also available on linux) or something like easyrsa (set of shell scripts to somewhat automate certificate management). Judging by the fact that you compare it to windows, you most likely want to use xca. ---------------------------------------------------------------------- vivekkhera · 2022-11-22 23:24 If you want to run your own root CA and install your root cert into all of your clients, yes you can do that with the OpenSSL cli. It is non trivial. I use the CA GUI provided by pfSense to manage my own CA for my private services. It is pretty easy to use. I’m sure there are other stand-alone CA tools built on OpenSSL. ---------------------------------------------------------------------- scorc1 · 2022-11-23 00:45 Yeah, i was thinking about certbot if/where i can to interact with it ---------------------------------------------------------------------- scorc1 · 2022-11-23 00:46 Yeah. Would probably be rough. Just looking for how to do it/other ways to do it/available options. Ill check out that xca ---------------------------------------------------------------------- vivekkhera · 2022-11-23 00:55 I did not know certbot supported your own root. I use it to manage my public certificates from letsencrypt. ---------------------------------------------------------------------- allegedrc4 · 2022-11-23 04:01 I like XCA. Create your templates and then it's pretty simple. ---------------------------------------------------------------------- port53 · 2022-11-23 05:36 xca erry day. ---------------------------------------------------------------------- RunningPhoenix · 2022-11-23 06:21 You might consider running your CA with something like smallstep ([https://smallstep.com/](https://smallstep.com/)) as this would also allow you to run an ACME server. Once running you could request certificates from it using something like certbot. Like others have said though, you can certainly run a CA using just the standard OpenSSL tools. ---------------------------------------------------------------------- scorc1 · 2022-11-23 15:53 Thats the normal way. But there is a --server switch and you can point it wherever. Or, so it seems. Might want to double check me. All i saw was a forum post of theirs, not the official docs. ---------------------------------------------------------------------- scorc1 · 2022-11-23 15:59 I saw them. Their web page or blog post, really turned me off. Every other sentence was them saying how they owned small-ca by small step, a small stop offering. By smallstep. I wanted to strangle them. I know its yours. The weburl was smallstep.com the banners, header and footer say smallstep. I don't need it in every flippin sentence to do the setup. Idk, maybe thats normal... I may try them out still if i don't find an alternative. It was so bad. ---------------------------------------------------------------------- [deleted] · 2022-11-23 19:49 [deleted] ---------------------------------------------------------------------- usernamefindingsucks · 2022-11-23 19:53 Smallstep? [https://smallstep.com/docs/step- ca/installation/#freebsd](https://smallstep.com/docs/step- ca/installation/#freebsd) [https://www.freshports.org/security/step- certificates/](https://www.freshports.org/security/step-certificates/) [https://www.freshports.org/security/step- cli/](https://www.freshports.org/security/step-cli/) ---------------------------------------------------------------------- AfraidJournalist · 2022-11-28 14:55 If you want to use OpenSSL for this, [this article](https://jamielinux.com/docs/openssl-certificate-authority/) gives a good tutorial on how to do so. To save time and for convenience, I'd also recommend XCA.