Self-Signed CA - Revision history

Datanasov: Remove inert legacy #ae8c55 wrapper (superseded by site CSS)

2026-08-09T21:02:38Z

Remove inert legacy #ae8c55 wrapper (superseded by site CSS)

← Older revision		Revision as of 21:02, 9 August 2026
Line 1:		Line 1:
	~~<div style = "line-height: 1.2">~~		{{clear}}
	{{clear}}~~</div></div><div style = "margin-top: 1.5em; border: 3px solid #ae8c55; border-radius: .5em; padding: 1em 1.5em; font-size: 1.2em">~~
	~~<strong></strong>~~
	== Home Lab: mkcert & System Trust ==		== Home Lab: mkcert & System Trust ==

Datanasov: /* 6. Verification */

2026-05-14T10:34:55Z

6. Verification

← Older revision		Revision as of 10:34, 14 May 2026
Line 48:		Line 48:
	=== 6. Verification ===		=== 6. Verification ===
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	curl -I https://~~speed~~.example.com		curl -I https://host.example.com
	</syntaxhighlight>		</syntaxhighlight>
	[[Category:Howto]]		[[Category:Howto]]

Datanasov at 10:33, 14 May 2026

2026-05-14T10:33:27Z

@@ Line 1: / Line 1: @@
 == Home Lab: mkcert & System Trust ==
@@ Line 47: / Line 50: @@
 curl -I https://speed.example.com
 </syntaxhighlight>

Datanasov: Created page with "== Home Lab: mkcert & System Trust == === 1. Install mkcert & Root CA (Main Server Only) === Run these commands on the machine that will act as your Certificate Authority. sudo apt update && sudo apt install libnss3-tools -y wget -O mkcert "https://dl.filippo.io/mkcert/latest?for=linux/amd64" chmod +x mkcert sudo mv mkcert /usr/local/bin/ mkcert -install === 2. Generate the Domain Certificate === Generate the wildcard c..."

2026-05-14T10:32:19Z

Created page with "== Home Lab: mkcert & System Trust == === 1. Install mkcert & Root CA (Main Server Only) === Run these commands on the machine that will act as your Certificate Authority. <syntaxhighlight lang="bash"> sudo apt update && sudo apt install libnss3-tools -y wget -O mkcert "https://dl.filippo.io/mkcert/latest?for=linux/amd64" chmod +x mkcert sudo mv mkcert /usr/local/bin/ mkcert -install </syntaxhighlight> === 2. Generate the Domain Certificate === Generate the wildcard c..."

New page

== Home Lab: mkcert & System Trust ==

=== 1. Install mkcert & Root CA (Main Server Only) ===
Run these commands on the machine that will act as your Certificate Authority.

<syntaxhighlight lang="bash">
sudo apt update && sudo apt install libnss3-tools -y
wget -O mkcert "https://dl.filippo.io/mkcert/latest?for=linux/amd64"
chmod +x mkcert
sudo mv mkcert /usr/local/bin/
mkcert -install
</syntaxhighlight>

=== 2. Generate the Domain Certificate ===
Generate the wildcard certificate and private key for your domain. You will upload the resulting .pem files to your reverse proxy (e.g., Nginx Proxy Manager).

<syntaxhighlight lang="bash">
mkcert "*.example.com" "example.com"
</syntaxhighlight>

=== 3. Distribute the Root CA ===
Copy the rootCA.pem from your main server to the target machines so they can trust your new proxy certificates.

<syntaxhighlight lang="bash">
# Run on Main Server to push to target
scp $(mkcert -CAROOT)/rootCA.pem <user>@<remote-ip>:/tmp/rootCA.pem
</syntaxhighlight>

=== 4. Trust the CA: Debian / Ubuntu / Proxmox ===
Run these commands on headless Debian-based consoles.

<syntaxhighlight lang="bash">
sudo cp /tmp/rootCA.pem /usr/local/share/ca-certificates/example-ca.crt
sudo update-ca-certificates
</syntaxhighlight>

=== 5. Trust the CA: Fedora / RHEL / CentOS / Rocky ===
Run these commands on headless Fedora-based consoles.

<syntaxhighlight lang="bash">
sudo cp /tmp/rootCA.pem /etc/pki/ca-trust/source/anchors/example-ca.pem
sudo update-ca-trust
</syntaxhighlight>

=== 6. Verification ===
<syntaxhighlight lang="bash">
curl -I https://speed.example.com
</syntaxhighlight>