Self Hosted PKI reddit / selfhosted ---------------------------------------------------------------------- Jason_Funderburker_ · 2023-12-24 12:21 Hey all, I’m looking for some self-hosted PKI options. I want valid https/ssl certs for my internal services, and I don’t want to renew a letsencrypt cert every 3 months. I tried OpenXPKI, but setting that up was a huge pain, and once I got it set up, I think I hit a product bug in the notification handler, so I can’t even try it out. Been looking at alternatives and have seen good things about Vault. Anyone else have any other suggestions, or can speak to Vault? ---------------------------------------------------------------------- deyavi · 2023-12-24 12:41 I've used XCA quite a bit in the past. It works pretty well and it's easy to use. Keep in mind though that you'll have to add your CA to the trust store on esch device you will access your services from, otherwise you'll get errors since they are not trusted. I would just use Let's Encrypt and automate the renewal process. ---------------------------------------------------------------------- Jason_Funderburker_ · 2023-12-24 12:54 is there any easy way to automate a bunch of renewals? rolling my own script seems like a lot of work, so I haven't investigated it. tbh, I only access my services from one or two devices at the moment, so installing a custom root doesn't seem like that much of a pain. ---------------------------------------------------------------------- BadgerBourne · 2023-12-24 13:13 https://github.com/cloudflare/cfssl ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-24 13:24 If you want ACME automation, this is the way: [https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi- yubikey/](https://smallstep.com/blog/build-a-tiny-ca-with-raspberry- pi-yubikey/) (sure, you can use it without the Yubikey and RNG also). XCA is a great tool as well, if you don't need ACME. Personally I went the old-fashioned way with OpenSSL. Currently running only long-term certs, if I ever need ACME + short term certs in the future, I'd spin up a subCA with `step-ca`. ---------------------------------------------------------------------- s2s2s97 · 2023-12-24 13:36 I went a super roundabout way but am really happy with what I have now. I started by setting up an offline root CA on windows server and then used my existing AD Domain Controller as an intermediate CA that issues certs to all AD joined devices and users. Realizing this is kind of a pain for my primarily Linux environment, i setup StepCA as another intermediate CA for all web services due to its ease of use. The pro with having PKI hierarchy is all devices only need to trust the root CA and then they will trust all other CAs in the chain. If you want more specific details about how I set mine up let me know! [AD PKI setup](https://youtu.be/2bz0W8FFG0s?si=o7eHW1u1QJjqAJql) ---------------------------------------------------------------------- niceman1212 · 2023-12-24 13:58 What is the dealbreaker with letsencrypt? Lots of ways to automate that ---------------------------------------------------------------------- drexdamen · 2023-12-24 14:18 Not OP, but I can think of various reasons, among those are: * only works with externally fully functional domain names * can't get valid certificates for internal IPs ---------------------------------------------------------------------- Nemergal · 2023-12-24 14:25 OpenSSL have a lots of options. Difficult to get a GUI for all cases, depending of your needs. I followed this excelent guide: https://jamielinux.com/docs/openssl- certificate-authority/ I manage my CA through folders, like the tutorial. And I have few custom bash scripts to create/revoke/manage my certificates. ---------------------------------------------------------------------- phein4242 · 2023-12-24 14:26 LE does not work without internet access. ---------------------------------------------------------------------- Jason_Funderburker_ · 2023-12-24 14:31 pretty much what /u/drexdamen said. I don't really feel like putting external DNS entries in for internal services, and internal IPs aren't allowed for externally-verified certs. ---------------------------------------------------------------------- hcr2018 · 2023-12-24 14:35 Not true https://youtu.be/qlcVx-k-02E?si=Lpy0PsyXXsOv_t5a I have it installed with my internal network ---------------------------------------------------------------------- timothyclaypole · 2023-12-24 14:57 I’m using bounCA as a basic GUI on top of OpenSSL - seems to work well for my limited use case. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-12-24 15:08 Also publishes all issued certificates publicly (CT) ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-12-24 15:10 Yet to try it, but HashiCorp meets your requirements. https://developer.hashicorp.com/vault/tutorials/secrets- management/pki-engine could provide a starting point. ---------------------------------------------------------------------- gargravarr2112 · 2023-12-24 15:20 OpenVPN created EasyRSA for this reason: [https://easy- rsa.readthedocs.io/en/latest/advanced/](https://easy- rsa.readthedocs.io/en/latest/advanced/) I use it for my internal CA. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-24 15:29 Internal CA can do a lot more than just TLS certs: * internal domains. Starting with RFC 8375 \`.home.arpa\`, ending with corporate networks, where using's Let's Encrypt etc **is prohibited** by policy. * cases where privacy matters and you don't want \`Just use Let's Encrypt\` because it will push a lot of info (**including IP address from where you did the request**) to CT logs * mTLS aka client TLS authentications * ... namely, cert-based VPN auth, i.e. OpenVPN * EFS certificates * BitLocker Data Recovery Agent * Certificates for IP addresses * Code signing *(little practical use though, only for in-house tools)* * S/MIME *(again, suitable only for in-house applications)*. * Exotic cases where you have to use [less-than-publicly-allowed](http s://www.reddit.com/r/selfhosted/comments/11uyw5s/comment/jcsmulg/?cont ext=3) key sizes * TLS interception (for debugging, forensics, reverse engineering) ---------------------------------------------------------------------- LifeisInevitable · 2023-12-24 15:30 I don't understand how you expect a non-internet connected device to query an external server to get a certificate? ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-24 15:36 'Without internet access' usually means networks without any routes to global address space, and not LANs. ^(Ofc, you can get a valid LE cert even for your isolated network in your log cabin in the woods, if you submit a CSR from another online machine and perform the challenge. But it's usually not worth the trouble.) ---------------------------------------------------------------------- Trustworthy_Fartzzz · 2023-12-24 15:37 Air gapped home lab is a level of paranoia I hope to avoid. ---------------------------------------------------------------------- Simon-RedditAccount · 2023-12-24 15:43 Severely-firewalled IoT subnet/VLAN is a healthy level of paranoia (provided that all your IoT devices can be controlled by a local server, and not manufacturers' clouds\_. ---------------------------------------------------------------------- phein4242 · 2023-12-24 16:01 You misunderstand how LE works. Having LE servers query a resource you control is mandatory, be it http-01 or dns-01. It will not work with airgapped or vpn-only networks. ---------------------------------------------------------------------- phein4242 · 2023-12-24 16:04 There is no need to connect services to the public internet if you dont want to share it with the world. This is not just airgapped networks, but also vpn-only networks. ---------------------------------------------------------------------- smnhdy · 2023-12-24 16:20 I just run an internal proxy. Works great. ---------------------------------------------------------------------- Jason_Funderburker_ · 2023-12-24 16:21 I'm currently in the process of setup of Vault, so I'm glad you recommended this. I think I like the UI of this the best out of all that I've seen so far, so I'll continue with my setup of Vault and give it a proper test drive. ---------------------------------------------------------------------- silence036 · 2023-12-24 16:29 If it's dns01, LE does not access your resources, only the public DNS records that your client added. You do need some access to edit the DNS, make the request and grab the cert tho so won't work for truly airgapped networks. For a homelab network this would be somewhat reasonable external access though since it doesn't expose your services. ---------------------------------------------------------------------- phein4242 · 2023-12-24 16:39 Why would you want to add public dns records for non-public resources? This way you leak information about non-public resources. ---------------------------------------------------------------------- cribbageSTARSHIP · 2023-12-24 17:03 Can you suggest some internal proxy options? ---------------------------------------------------------------------- hcr2018 · 2023-12-24 17:09 What is the point for the long run of using an ssl certificate without internet, except for Man in the middfle acttack /analysis ? If you want a MITM use the certificate in your local dns over https resolver like Adguardhome or dnscrypt proxy 2. ---------------------------------------------------------------------- LifeisInevitable · 2023-12-24 17:14 In my case, I'm using split DNS to access various services using a TLD that doesn't exist. Having an SSL cert which actually has a proper chain, so the root can be trusted, causes significantly less issues. For example, no invalid cert pop ups; less issues when querying another service, where requests can be blocked due to invalid certs; bit more minor, but the little warning triangle next to the lock; just to name a few. ---------------------------------------------------------------------- smnhdy · 2023-12-24 17:16 I’m using NGINX myself…. Works great both for internal and external proxy with SSL certificates. ---------------------------------------------------------------------- kayson · 2023-12-24 18:17 If you want very simple, I wrote this: [https://github.com/kaysond/spki](https://github.com/kaysond/spki) Based on this: [https://jamielinux.com/docs/openssl-certificate- authority/](https://jamielinux.com/docs/openssl-certificate- authority/) ---------------------------------------------------------------------- anyOtherBusiness · 2023-12-24 18:25 In DNS challenge, you don't publish any information about the resource. You just add a TXT record with a random token, no one but your certificate provider know what it's used for. ---------------------------------------------------------------------- Keplair · 2023-12-24 18:40 Check Bank Vault also :) ---------------------------------------------------------------------- phein4242 · 2023-12-24 18:42 Not quite, since it will verify a token published under the domain you want to have a certificate for, which implies the domain needs to be public. ---------------------------------------------------------------------- housepanther2000 · 2023-12-24 18:48 I'll plus one for XCA. But that much said, I use split brain DNS so I can use Let's Encrypt certificates internally as well. I use the DNS challenge with cloudflare so it's easy. ---------------------------------------------------------------------- ddpbsd · 2023-12-24 18:49 I setup a CA with libressl using the instructions in TLS Mastery. ---------------------------------------------------------------------- housepanther2000 · 2023-12-24 18:49 Certbot should take care of the renewals for you automatically via a systemd timer. ---------------------------------------------------------------------- niceman1212 · 2023-12-24 18:55 You can wildcard the dns entries I don’t quite understand what you mean with internal IPs If I set the DNS for my letsencrypt cents to internal IPs they still work fine ---------------------------------------------------------------------- drexdamen · 2023-12-24 20:29 Uhh, I did not know that. TIL. Thank you! ---------------------------------------------------------------------- drexdamen · 2023-12-24 20:34 By the way, have you checked Hashicorps Vault? It has been a while, but a few years back we used it in a company not only to store secrets, but also for certificates. There was a backend the did stuff like letsencrypt. I doubt that it was acme compatible, but it was api- webhooks to get certificates. And you could setup lifetime and stuff like that. ---------------------------------------------------------------------- lunakoa · 2023-12-25 00:18 I haven't tried but can you do client side certs with Lets encrypt? Also if you do allow let's encrypt can you deny others with let's encrypt from accessing your resources like vpn and specific https sites? ---------------------------------------------------------------------- niceman1212 · 2023-12-25 00:58 I don’t know, i don’t do mtls on my clients. Too much of a hassle and potentially a security breach for my peers using services. Connection/authorization is done via VPN and to answer your next question, yes (but I think both questions are more proxy related than specific to letsencrypt) Containers are only accessible via VPN cidr, acme-challenge pods are accessible temporarily publicly ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-12-25 01:30 Play around searching https://crt.sh. I encourage separation if you want security. It implies things about dns, certificates and outbound filtering. But people don't care about that. People just want products and reverse proxies. I'm bitter ---------------------------------------------------------------------- JBu92 · 2023-12-25 03:52 I run enterprise-scale PKI for a living. In my home setup, I don't have a need for automation; I'm genuinely okay manually renewing less than a dozen certs once a year (though for "corporate" CAs, all browsers still allow you to ignore the spec, so... you CAN do 10-year certs internally if you want to. YMMV with non-browser software). Of all the free-as-in-beer solutions I've tried at home, what I've landed on is a basic-bitch openssl CA setup. ---------------------------------------------------------------------- lunakoa · 2023-12-25 04:33 Yeah but even with VPN the requirement client side certs in addition to username and password should improve security quite a bit. ---------------------------------------------------------------------- drexdamen · 2023-12-25 12:05 Nice to see when I switched to LE been quite a while :) and to see all the shit I tested with the appropriate subdomains :) I can totally understand where you are coming from. People still use Cloudflare and think it's a good idea. But certificates have come a long way since I started securing work and private stuff with it. And I more than appreciate that it is free now. ---------------------------------------------------------------------- Diligent_Ad_9060 · 2023-12-25 13:07 I use LE wild card certificates for my personal stuff to mitigate the privacy issue with disclosing all my private infrastructure. But I agree, free to use and issued by a CA included in most public trust stores. Hassle free as opposed to running your own PKI and to provision CA certs to everything that requires it to establish trust. Or self-signed certificates that were standard for many things the time before LE/ZeroSSL. ---------------------------------------------------------------------- ia42 · 2023-12-25 13:47 cron was invented in the 70s and still going strong. Also u/Jason_Funderburker_ when I started using Let's Encrypt the certbot was still a bit unfriendly so I started with https://github.com/dehydrated-io/dehydrated and it's flawless. I highly recommend it. fast to set up and forget, and for as many domains as you need in one blow. ---------------------------------------------------------------------- hereisjames · 2023-12-25 23:20 Legocerthub - written by a Redditor, central LE certificate management, then you can retrieve the certs from each server using the API. ---------------------------------------------------------------------- hugosxm · 2023-12-27 09:42 I may sound like a weirdo but I installed a pfsense vm, disabled all the services I can to make it light, and I use the system -> certificates menu to run a light weight pki ^^, you have a nice gui to create CA, issue certs… i’m very happy with that weird solution… ---------------------------------------------------------------------- kon_dev · 2023-12-27 09:44 I used openssl directly in the past in my homelab, but got tired of adding my custom CA cert to all my devices manually (needed to support Windows, Linux, Android and iOS in combination with Firefox and Chrome and custom apps and restic). Therefore, I switched to acme.sh and the dns challenge via let's encrypt. It will automatically renew the certs for my reverse proxy and proxmox has also a build-in acme client. I plan to extend acme.sh to also replace the cert on my Synology via a deploy hook, if that is in place, I don't have manual steps any more and still valid certs for non-public services without having to trust CA certs on all my devices. I did not regret the switch, I use uptime-kuma to monitor the cert expiration, so I would get an alert if the renewal fails for some reason. ---------------------------------------------------------------------- akl_smsra · 2023-12-27 19:05 Check out Akeyless for internal PKI https://docs.akeyless.io/docs/ssh-and-pkitls-certificates ---------------------------------------------------------------------- EmanuelSchanderl · 2023-12-28 18:31 I setup FreeIpa as LDAP Backend, Domain Controller and because it brings the Dog tag PKI it's what I start to use as PKI but might use a secondary Small step instance to make it more accessible. my goal is to have internal SSL (especially between proxy and docker containers)