Skip to content

Latest commit

 

History

History
87 lines (55 loc) · 3.79 KB

README.md

File metadata and controls

87 lines (55 loc) · 3.79 KB
Raw

Just want simple TLS for your .internal network?

Run

./create-internal-constrained-pki.sh mydomain.internal

It creates a root CA certificate that your users (colleagues/friends/family) can safely add to their devices' trust store because it uses X.509 Name Constraints to provably restrict it to the chosen domain.

The CA cannot be used to MitM all traffic.

Result:

certs-and-keys/
    ca-mydomain.internal.crt           <- root CA certificate to give to your users
                                          to _safely_ add to their devices' trust store

    wildcard.mydomain.internal.crt     <- certificate and key to use for hosting services
    wildcard.mydomain.internal.key.pem    under mydomain.internal and *.mydomain.internal

Verification

Your users can run

openssl x509 -noout -text -in ca-mydomain.internal.crt

to verify which domains the root CA allows; it should show:

            X509v3 Name Constraints: critical
                Permitted:
                  DNS:mydomain.internal
                  DNS:.mydomain.internal

Important

  • Read the code of create-internal-constrained-pki.sh to see if it suites your goals:
    • Default VALIDITY_DAYS="3650"
    • No passphrases: The generated keys will be unencrypted (no passphrase) to allow the script to run without prompts. Generate them directly onto at-rest encrypted storage. If you want passphrases instead, add e.g. -aes256 to the openssl genrsa invocations.

Literature