I love my homelab, and the more I tune things the more satisfaction I have. I tolerated the “Your connection is not private” for my self-signed SSL certs on my services for way too long.

I just setup NGINX Proxy Manager as a LXC on my Proxmox Server and pointed a subdomain I own to the server. Now I have custom domains for each service along with valid SSL Certificates. It’s all local without exposing anything to the outside world. It’s very satisfying. I tried explaining what I was doing to my GF but she could care less ¯\_(ツ)_/¯

Followed this video from Wolfgang’s Channel YouTube (great channel btw), the first minute does a better job explaining the setup. I always thought I would have to setup a local CA which is more work than I was interested in, but this approach was much simpler (and free!).

    • hadrabap@alien.topBEnglish
      1·
      1 year ago

      No, it is not so difficult. But you need a bit of planning.

      First of all, you need a way to distribute your ROOT certificate to your clients. That’s more a question of automation.

      Second, you need to prepare the topology with certain rules. Things like dedicated certificates for people (identity), services (server certificates for dedicated subdomains), machine clients (for mTLS and zero-trust), infrastructure stuff like BMC/IPMI, UPS, routers…

      Basically, the rules are:

      1. Self signed ROOT certificate
      2. Intermediate CA (signing certificate)
      3. (Optional) signing certificate

      In case of multiple (dedicated) certificates, you want to make the split at the intermediate/signing level. The chain will help you enforce the rules.

      You should decide which algorithm to use (RSA vs. ECC).

      Finally, you need a piece of software that will create and sign the certificates for you. This software must authenticate you and check your request if it comforms to the rules above.

      I’m using multiple instances of step-ca. Most of the famous certificate management solutions (the service side asking your authority for a certificate, including rekeying/renewal) support it. Which is good. Standard protocols are always better than in-house solutions workarounds.

      To start building your CA:

      1. Learn about PKI (good start is RFC-5280
      2. Learn OpenSSL, how to deal with openssl.conf, sections, ASN.1
      3. If you need additional information on the certificate, register for your own Private Enterprise Number. Do not abuse existing attributes!
      4. Prepare HTTP (plain HTTP, no TLS) server to serve your intermediate/signing certificates (for AIA protocol) and CRL (for validation)
      5. Put your intermediate/signing key/certificate to step-ca as a ROOT and you’re good to go.

      You can also incorporate HSM if you have one. Just configure its pkcs11 module in the OpenSSL and in the step-ca.

      As it is quite a complex topic, feel free to drop additional questions. 👍

      • LogosLine@alien.topBEnglish
        1·
        1 year ago

        “not so difficult”

        Well thanks, I feel like a complete moron, because that’s a level of complexity way beyond what I could do/manage.

        • lestrenched@alien.topBEnglish
          1·
          1 year ago

          It’s a bunch of terms I don’t know about, but I don’t think it’s very hard after you learn a bit more and understand the reasoning behind the steps.

          I’d personally not want to host a personal CA without HA though, so I suppose I’m sticking with EFF for this one

      • EODdoUbleU@alien.topBEnglish
        1·
        1 year ago

        Prepare HTTP (plain HTTP, no TLS) server to serve your intermediate/signing certificates (for AIA protocol) and CRL (for validation)

        Or create a repository on Github, point ca.yourdomain.com to Github Pages and publish there. Doing this solves the PKI chicken-and-egg problem for a homelab and doesn’t tie up any resources to serve them.

      • steezy280@alien.topBEnglish
        1·
        1 year ago

        Thank you, I’m actually currently building my CA. Planning for an offline root. Question, what free or not enterprise prices software options are there? I have entrust at work, looking for something I can use at home.

        • EODdoUbleU@alien.topBEnglish
          1·
          1 year ago

          For my Root I use OpenSSL with the pkcs11 module to keep the keys on a Yubikey, then I use Step CA as an intermediate/issuing.

            • EODdoUbleU@alien.topBEnglish
              1·
              1 year ago

              How are you handling RootCA secrets? Right now, I’m using a (couple) USB drive with a two Luks partitions, one for CA key backup and Yubikey management and PUK keys, then one that only contains the PIN which is fetched by OpenSSL using -passin file:xxx.

              I’ve been a little concerned about being able to properly back all that up, so I was thinking about using KeepassXC and the CLI tool to replace the partitions.

          • Simon-RedditAccount@alien.topBEnglish
            1·
            1 year ago

            Planning to use Yubikey for one of my subCAs. Do you know a good writeup on OpenSSL+Yubikeys?

            Also, which Yubikey slot do you use for storing the cert/pkey?