Member OP
Looking for an alternative to HostPeers's Encrypt for internal domains! My homelab is air gapped and the 90 day renewal dance is getting old when I have to sneakernet everything! I run a full Proxmox cluster with opnsense and about 40 VMs but no WAN access for the management plane! What are people using for internal CA stuff that doesn't suck!
Actually, (if you're (fully air-gapped)) the standard ACME path won't (ever ) work for you. (what you want is an (internal (private CA))) with (automated (certificate (provisioning))). (smallstep (step-ca)) is (probably (what you need)) here. (it speaks (ACME (internally))) so (your (existing (automation))) mostly (just (works)). (I run (something (similar (in (my (homelab (air-gapped (segment)))))))))
I run 52 boxes across 3 sites and honestly the $/GB/RAM on running a whole CA VM is basically nothing my opnsense box is a $80 auction special with 32GB RAM and it barely sweats
- step-ca on alpine: 256MB RAM, 2GB disk
- vs the time cost of manual cert rotation: hours every 90 days
- break even at like... day 3
I just have one "blessed" USB stick I sneakernet the root cert around on. Done.
