Self-hosted Certificate Authority for mTLS
reddit / selfhosted

----------------------------------------------------------------------
Jazzlike-Poem-1253 · 2023-12-13 22:31

Hi,


I use a roll-your-own PKI/CA using [python
cryptography](https://cryptography.io/en/latest/), which is cumbersome
to maintain and operate.

I am looking for a simple and easy, open source tool to replace my
Python scripts to occasionally store keys and sign certificates in the
context of mutual TLS. I found ejbca, vault step-ca and others but am
not sure what is the right fit for me.

​

Are there any recommendations and experiences? Please let me know,
cheers!

----------------------------------------------------------------------
No-Command9510 · 2023-12-13 22:43

do you use opnsense or pfsense? they have a ca included

----------------------------------------------------------------------
Jazzlike-Poem-1253 · 2023-12-14 00:40

Wasn't aware of these. But seems a bit oversiued, just for the CA and
I do not plan on a dedicated firewall.

----------------------------------------------------------------------
hereisjames · 2023-12-14 15:35

Smallstep (ie `step-ca`) is pretty comprehensive and has good
documentation.

----------------------------------------------------------------------
waeking · 2023-12-14 17:20

This works well with traefik too

----------------------------------------------------------------------
dcagatay · 2023-12-14 21:57

Definitely recommended, ACME support is also great.

----------------------------------------------------------------------
Jazzlike-Poem-1253 · 2023-12-14 23:30

Ah, cool. Using traefik anyways - will give it a try!