Welcome to the staging ground for new communities! Each proposal has a description in the "Descriptions" category and a body of questions and answers in "Incubator Q&A". You can ask questions (and get answers, we hope!) right away, and start new proposals.

Post History

60%

+1 −0

Incubator Q&A Proper way to create your own TLS certificates

On sandboxes For sandboxed development and test environments, I have found mkcert to be pretty helpful. It creates a root CA and happily creates certificates for whatever DNS you want. mkcert war...

posted 3mo ago by Michael‭ · edited 2mo ago by Michael‭

Answer

#2: Post edited by

Michael‭ · 2024-03-26T19:19:12Z (about 2 months ago)
Link LE. More LE detail from comment thread.

Copy Link

Raw

Markdown

~~### On sandboxes~~
For sandboxed development and test environments, I have found [`mkcert`][mkcert] to be pretty helpful. It creates a root CA and happily creates certificates for whatever DNS you want.
`mkcert` warns you not to use it in production. Also, be aware that if you install the root CA to your local computer directly (ie not in a carefully partitioned VM or container), someone with access to the private key can mint a certificate for anything and your computer will believe it.[^1]
~~### Just use Let's Encrypt~~
The network admin answer is to own a public domain name, pick a subdomain (eg `local.example.com`), put your local network on that and make sure DNS lookups inside the network go to the appropriate place. Then rig LetsEncrypt renewals to let them talk to your server with public DNS, just for the ceremony.
~~### So you really want to be a CA?~~
The "real" answer ideally [involves some kind of HSM][hsm] to own the key. Then you issue [some `openssl` signing requests][so]. OpenSSL is unfortunately not the most intuitive program to use.
[^1]: I think this is why you're asking the question in the first place.
[mkcert]: https://github.com/FiloSottile/mkcert
[hsm]: https://colinpaice.blog/2021/03/08/using-openssl-with-an-hsm-keystore-and-opensc-pkcs11-engines/
[so]: https://stackoverflow.com/a/60516812/241211

## On sandboxes
For sandboxed development and test environments, I have found [`mkcert`][mkcert] to be pretty helpful. It creates a root CA and happily creates certificates for whatever DNS you want.
`mkcert` warns you not to use it in production. Also, be aware that if you install the root CA to your local computer directly (i.e. not in a carefully partitioned VM or container), someone with access to the private key can mint a certificate for anything and your computer will happily believe it.[^1]
## Just use [Let's Encrypt][le]
The network admin answer is to own a domain name, pick a subdomain (e.g. `local.example.com`), put your local network on that, and make sure DNS lookups inside the network go to the appropriate place. Then communicate with LetsEncrypt via your DNS for `certbot` renewals.
One possible downside is that the IP of the computer running the `certbot` requests will be permanently included in [certificate transparency logs][crt.sh]. I don't mean to scare anyone, but you should know.
### You don't own a domain name
Not a problem. A comment thread below suggests using a public DNS service[^ddns] to be the domain name, and you get to be a subdomain of it. (You can then choose whether your local network's public suffix is one level deeper or the subdomain itself.)
## So you really want to be a CA?
The "real" answer ideally [involves some kind of HSM][hsm] to own the key. Then you issue [some `openssl` signing requests][so]. OpenSSL is unfortunately not the most intuitive program to use.
[^1]: I think this is why you're asking the question in the first place.
[^ddns]: I don't personally endorse any. The comment thread mentions [afraid][], and I have also heard of [no-ip][], [dyn][], and [duck][].
[mkcert]: https://github.com/FiloSottile/mkcert
[le]: https://letsencrypt.org/
[hsm]: https://colinpaice.blog/2021/03/08/using-openssl-with-an-hsm-keystore-and-opensc-pkcs11-engines/
[so]: https://stackoverflow.com/a/60516812/241211
[crt.sh]: https://crt.sh
[no-ip]: https://www.noip.com
[dyn]: https://dyn.com
[afraid]: https://freedns.afraid.org
[duck]: https://www.duckdns.org

#1: Initial revision by

Michael‭ · 2024-03-04T19:49:39Z (3 months ago)

Copy Link

Raw

Markdown

### On sandboxes
For sandboxed development and test environments, I have found [`mkcert`][mkcert] to be pretty helpful. It creates a root CA and happily creates certificates for whatever DNS you want.

`mkcert` warns you not to use it in production. Also, be aware that if you install the root CA to your local computer directly (ie not in a carefully partitioned VM or container), someone with access to the private key can mint a certificate for anything and your computer will believe it.[^1]

### Just use Let's Encrypt
The network admin answer is to own a public domain name, pick a subdomain (eg `local.example.com`), put your local network on that and make sure DNS lookups inside the network go to the appropriate place. Then rig LetsEncrypt renewals to let them talk to your server with public DNS, just for the ceremony.

### So you really want to be a CA?
The "real" answer ideally [involves some kind of HSM][hsm] to own the key. Then you issue [some `openssl` signing requests][so]. OpenSSL is unfortunately not the most intuitive program to use.

[^1]: I think this is why you're asking the question in the first place.

[mkcert]: https://github.com/FiloSottile/mkcert
[hsm]: https://colinpaice.blog/2021/03/08/using-openssl-with-an-hsm-keystore-and-opensc-pkcs11-engines/
[so]: https://stackoverflow.com/a/60516812/241211

Communities

Post History