On 12/13/23 21:50, Charles Curley wrote:
On Thu, 14 Dec 2023 09:34:37 +0800 jeremy ardley <jeremy.ardley@gmail.com> wrote:You don't have to be your own CA. It's very easy to use letsencrypt to generate valid certificates for hosts even if they are not directly connected to the internet.Oooh, is there a writeup somewhere on how to do that? The last time I looked, I couldn't find one. But that was a while ago.
I am following the one at https://jamielinux.com/docs/openssl-certificate-authority
it is from 2015 and I made the scripts from the different stages in the chapter.
root, intermediate and client. I will consolidate them into a single script when I have everything working. I will then add the revocation, CRL and OCSP at the end of testing.I intend to the encrypt the directory holding the CA with fscrypt to keep the private keys secure.
-- It's not easy to be me