Self-Signed CA
From LinuxizeNet
Home Lab: mkcert & System Trust[edit]
1. Install mkcert & Root CA (Main Server Only)[edit]
Run these commands on the machine that will act as your Certificate Authority.
sudo apt update && sudo apt install libnss3-tools -y
wget -O mkcert "https://dl.filippo.io/mkcert/latest?for=linux/amd64"
chmod +x mkcert
sudo mv mkcert /usr/local/bin/
mkcert -install
2. Generate the Domain Certificate[edit]
Generate the wildcard certificate and private key for your domain. You will upload the resulting .pem files to your reverse proxy (e.g., Nginx Proxy Manager).
mkcert "*.example.com" "example.com"
3. Distribute the Root CA[edit]
Copy the rootCA.pem from your main server to the target machines so they can trust your new proxy certificates.
# Run on Main Server to push to target
scp $(mkcert -CAROOT)/rootCA.pem <user>@<remote-ip>:/tmp/rootCA.pem
4. Trust the CA: Debian / Ubuntu / Proxmox[edit]
Run these commands on headless Debian-based consoles.
sudo cp /tmp/rootCA.pem /usr/local/share/ca-certificates/example-ca.crt
sudo update-ca-certificates
5. Trust the CA: Fedora / RHEL / CentOS / Rocky[edit]
Run these commands on headless Fedora-based consoles.
sudo cp /tmp/rootCA.pem /etc/pki/ca-trust/source/anchors/example-ca.pem
sudo update-ca-trust
6. Verification[edit]
curl -I https://host.example.com
