After much wrangling, and more than a few profanities in-between, I managed to setup the certificate infrastructure I’ve been wanting for my home systems. That is to say, the joy that is working certificates–and not having to hand manage them.
Beating step-ca into the desired environment took a bit of wrangling, mainly because it wasn’t clear that --pki passed to the init command skips writing out a configuration file under $STEPPATH/config. It’s much less bollocking if you just let it use ~/.step instead of making it play like a traditional unix system service. But provides the key missing link that I’ve never had the last time I suffered rigging an OpenSSL based PKI: support for ACME!
Now that modern operating systems largely restrict TLS certificates to about a year, and projections show it will only get more restrictive, I think it’s essential for a protocol like ACME provisioning to be in place. It’s less setup certs that live the life of the machine and more expect them to be short-lived, transient with the trust relationship to the internal CA being what lasts.
I’ve generally felt that as time goes on the only good reason not to use HTTPS and TLS when available is not wanting to understand how it works, or having to deal with vintage computers. Well, I only have the latter of those problems, and I’m not so inclined to hook up older clients to such infrastructure. It’s never been the understanding part that’s been the problem for me, so much as the ‘dang it, another thing to back up’ and quite frankly, that problem has largely been automated at this point.
Also given how I ended up with 3 name servers around here, I rather figure an internal certificate authority “2nd edition” is worth it.