Editing Self-Signed CA

== Home Lab: mkcert & System Trust ==

=== 1. Install mkcert & Root CA (Main Server Only) ===
Run these commands on the machine that will act as your Certificate Authority.

<syntaxhighlight lang="bash">
sudo apt update && sudo apt install libnss3-tools -y
wget -O mkcert "https://dl.filippo.io/mkcert/latest?for=linux/amd64"
chmod +x mkcert
sudo mv mkcert /usr/local/bin/
mkcert -install
</syntaxhighlight>

=== 2. Generate the Domain Certificate ===
Generate the wildcard certificate and private key for your domain. You will upload the resulting .pem files to your reverse proxy (e.g., Nginx Proxy Manager).

<syntaxhighlight lang="bash">
mkcert "*.example.com" "example.com"
</syntaxhighlight>

=== 3. Distribute the Root CA ===
Copy the rootCA.pem from your main server to the target machines so they can trust your new proxy certificates.

<syntaxhighlight lang="bash">
# Run on Main Server to push to target
scp $(mkcert -CAROOT)/rootCA.pem <user>@<remote-ip>:/tmp/rootCA.pem
</syntaxhighlight>

=== 4. Trust the CA: Debian / Ubuntu / Proxmox ===
Run these commands on headless Debian-based consoles.

<syntaxhighlight lang="bash">
sudo cp /tmp/rootCA.pem /usr/local/share/ca-certificates/example-ca.crt
sudo update-ca-certificates
</syntaxhighlight>

=== 5. Trust the CA: Fedora / RHEL / CentOS / Rocky ===
Run these commands on headless Fedora-based consoles.

<syntaxhighlight lang="bash">
sudo cp /tmp/rootCA.pem /etc/pki/ca-trust/source/anchors/example-ca.pem
sudo update-ca-trust
</syntaxhighlight>

=== 6. Verification ===
<syntaxhighlight lang="bash">
curl -I https://speed.example.com
</syntaxhighlight>