Self-Signed CA: Difference between revisions
From LinuxizeNet
No edit summary |
(Remove inert legacy #ae8c55 wrapper (superseded by site CSS)) |
||
| (One intermediate revision by the same user not shown) | |||
| Line 1: | Line 1: | ||
{{clear}} | |||
{{clear}} | |||
== Home Lab: mkcert & System Trust == | == Home Lab: mkcert & System Trust == | ||
| Line 48: | Line 46: | ||
=== 6. Verification === | === 6. Verification === | ||
<syntaxhighlight lang="bash"> | <syntaxhighlight lang="bash"> | ||
curl -I https:// | curl -I https://host.example.com | ||
</syntaxhighlight> | </syntaxhighlight> | ||
[[Category:Howto]] | [[Category:Howto]] | ||
Latest revision as of 21:02, 9 August 2026
Home Lab: mkcert & System Trust[edit]
1. Install mkcert & Root CA (Main Server Only)[edit]
Run these commands on the machine that will act as your Certificate Authority.
sudo apt update && sudo apt install libnss3-tools -y
wget -O mkcert "https://dl.filippo.io/mkcert/latest?for=linux/amd64"
chmod +x mkcert
sudo mv mkcert /usr/local/bin/
mkcert -install
2. Generate the Domain Certificate[edit]
Generate the wildcard certificate and private key for your domain. You will upload the resulting .pem files to your reverse proxy (e.g., Nginx Proxy Manager).
mkcert "*.example.com" "example.com"
3. Distribute the Root CA[edit]
Copy the rootCA.pem from your main server to the target machines so they can trust your new proxy certificates.
# Run on Main Server to push to target
scp $(mkcert -CAROOT)/rootCA.pem <user>@<remote-ip>:/tmp/rootCA.pem
4. Trust the CA: Debian / Ubuntu / Proxmox[edit]
Run these commands on headless Debian-based consoles.
sudo cp /tmp/rootCA.pem /usr/local/share/ca-certificates/example-ca.crt
sudo update-ca-certificates
5. Trust the CA: Fedora / RHEL / CentOS / Rocky[edit]
Run these commands on headless Fedora-based consoles.
sudo cp /tmp/rootCA.pem /etc/pki/ca-trust/source/anchors/example-ca.pem
sudo update-ca-trust
6. Verification[edit]
curl -I https://host.example.com
