armstrongvds
Member
OP
ARM Enjoyer
- Joined:
- Jun 2024
- Posts:
- 199
- From:
- Seoul, KR
My local.test certs keep expiring every 30 days and it's driving me nuts! I was using a self-signed setup but the browser warnings are endless. Looked at mkcert which seems sweet but needs root trust store install on every machine.
For our team we have ~20 devs on ARM Ampere workstations (insane value, runs circles around x86 for the price!) and I want something that scales without everyone running manual steps.
Currently considering:
- Mkcert per dev + internal CA
- Let's Encrypt staging (rate limits scare me)
- Wildcard cert for *.dev.company.com
What works for you folks?
one small ping for man...
SingaporeRep
Member
Benchmark Addict
- Joined:
- Jul 2024
- Posts:
- 227
- From:
- Singapore, SG
Mkcert on Ampere Altra:
$ openssl speed rsa2048
sign verify sign/s verify/s
rsa 2048 bits 0.000456s 0.000014s 2192.9 71428.6
$ mkcert -install
Created a new local CA
The local CA is now installed in the system trust store!
$ mkcert devsite.test "*.devsite.test"
Using the local CA at /home/dev/.local/share/mkcert
Created a new certificate valid for the following names
- "devsite.test"
- "*.devsite.test"
The certificate is at "./devsite.test+1.pem"
Decent disk IO, meh network. CA generation 2.2k signs/sec. One-time hit.
Comparison:
- Self-signed: manual browser exceptions, unscalable
- LE staging: 30d expiry, external dependency
- Mkcert: 825-day local certs, offline, free
- Wildcard shared: key distribution nightmare
fio, iperf, geekbench. results or gtfo.
mediaaustin
Member
Deliverability Nerd
- Joined:
- Jul 2024
- Posts:
- 276
- From:
- Austin, US
Has anyone tried Vultr's dev-tier CA? They have an API for short-lived certs that doesn't need ACME polling.
Mkcert with a shared internal CA cert (not key!) is what most teams land on.
We did this for a while but onboarding new hires still meant a support ticket to get the root into their trust store. Not terrible, just another step.
What I actually want is something that works inside Docker without volume-mounting secrets everywhere. The mkcert approach gets messy when your containers are ephemeral.
Did you ever solve the ARM build issue for the CA tooling or are you just running x86 binaries under emulation
SPF, DKIM, DMARC — holy trinity ✉️
armstrongvds
Member
OP
ARM Enjoyer
- Joined:
- Jun 2024
- Posts:
- 199
- From:
- Seoul, KR
Mkcert with a shared internal CA cert (not key!) is what most teams land on. One-time trust install, then per-dev certs auto-generated. Light touch for admins, zero cost.
This is where we landed too. Puppet drops the CA cert on first boot, devs never think about it again.
Still curious about the ARM angle though — anyone running mkcert's cert generation at scale on Ampere? Our Ansible run is noticeably slower than on our old x86 boxes and I'm wondering if it's the crypto ops or just IO.
one small ping for man...
