Self-Signed CA

Home Lab: mkcert & System Trust

1. Install mkcert & Root CA (Main Server Only)

Run these commands on the machine that will act as your Certificate Authority.

sudo apt update && sudo apt install libnss3-tools -y
wget -O mkcert "https://dl.filippo.io/mkcert/latest?for=linux/amd64"
chmod +x mkcert
sudo mv mkcert /usr/local/bin/
mkcert -install

2. Generate the Domain Certificate

Generate the wildcard certificate and private key for your domain. You will upload the resulting .pem files to your reverse proxy (e.g., Nginx Proxy Manager).

mkcert "*.example.com" "example.com"

3. Distribute the Root CA

Copy the rootCA.pem from your main server to the target machines so they can trust your new proxy certificates.

# Run on Main Server to push to target
scp $(mkcert -CAROOT)/rootCA.pem <user>@<remote-ip>:/tmp/rootCA.pem

4. Trust the CA: Debian / Ubuntu / Proxmox

Run these commands on headless Debian-based consoles.

sudo cp /tmp/rootCA.pem /usr/local/share/ca-certificates/example-ca.crt
sudo update-ca-certificates

5. Trust the CA: Fedora / RHEL / CentOS / Rocky

Run these commands on headless Fedora-based consoles.

sudo cp /tmp/rootCA.pem /etc/pki/ca-trust/source/anchors/example-ca.pem
sudo update-ca-trust

6. Verification

curl -I https://host.example.com