A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
https://smallstep.com/docs/step-ca/index.html
There's basically two executables involved:
step is the CLI app used to request certificatesstep-ca is the server process the step client connects toI've got the CA portion bundled into Docker. It can also run as an ACME server (and is compatible with certbot).
This is exactly what i wanted to say :)
step-ca does not currently support active revocation mechanisms like a Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP).
Meh. Doesn't do what I need it to. :/
Does seem like automatic CRL/OCSP is something you only get for free with EJBCA. Frustrating, that.
This entire question has oxymorons all over it, but...
Sadly, most of the ones I've found are too complicated, and getting all devices to accept the CA is more hassle than it's worth for self hosting. I've given up and just buy my wildcard cert for 60$/yr and just put it on everything.
fyi you can get a wildcard from letsencrypt for free
I'm a trained netsec professional so handling keys and such is not really a hassle for me. What is a hassle IMO is having to manually do more things than hitting the "revoke" button to fully properly revoke a certificate, so that's where the CRL/OCSP req comes from.
Looks like that part is something you really only get for free with EJBCA, which I've tried and found very exhausting to use for my home network. If I had to pick one for work I'd probably go with EJBCA though, seems worth the effort if you're doing more complex things.
If overcomplicating things is a concern for you, then just use let's encrypt. Running your own ca is a pain in the ass and probably decreases security for most people due to the difficulty of doing it correctly.
Nobody needs ocsp or clr in their homelab. And if they’re a trained netsec professional they know that its far better with short-lived certs than any revocation model. Both zerossl and letsencrypt are easy to use - and works flawlessly with something like caddy on a wildcard domain, or an acme proxy. Openssl is easy, and you can clr with that or even use their ocsp for homelab.