Vielleicht interessant für manche #homeserver Besitzer:innen, die ihre Systeme nur in ihrem - vom Internet "isolierten" -Heimnetz nutzen, aber trotzdem nicht auf SSL verzichten möchten:

Mit #smallstep lässt sich innerhalb von Minuten eine eigene CA aufsetzen.

https://github.com/smallstep/certificates

100$? no way. The Yubikey is 60€, the TRNG is 30€ + shipping alone, not to mention the RPI

https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/

And, after some hard work, and a few struggles with #Docker, #DNS and #Firewall rules, I finally have been able to install #StepCA from #SmallStep on my #HomeLab, so now I have a nice private #CertificateAuthority with which I can use #Certbot to manage my service certificates in a #LetsEncrypt style. Took a lot of notes. Blog post will come eventually! (too tired right now)
https://smallstep.com/docs/step-ca/

I've written a new post about setting up Smallstep's step-ca as an SSH and TLS CA, using a Yubikey 4 as a HSM to store the online keys safely.

https://i.am.eddmil.es/yubipica/

Major credit to @tashian, as their blog post contains very detailed setup instructions for most of the setup, which I expanded to add the SSH Certificate functionality.

On #repatriation - #Rohingyas have #MixedOpinions from #distrust of #Junta & #fear of #persecution still in their mind. The #PilotProject is that #SmallStep that needs to be taken. 
On the other hand, #deadline for #Myanmar #counterargument in the Rohingya #genocide case at the #InternationalCourt of #Justice (#ICJ ) has been set for April 24 this year. To some experts, the sudden repatriation plan has #connection w/the #GenocideCase

https://thegeopolitics.com/will-the-junta-come-out-from-their-cocoon-to-accept-rohingyas

Is it possible to install a client TLS client certificate on an iPhone running iOS 16?

I'm trying to do it but can't get it to show the certificate as verified (even though the Root and Intermediate CAs are both installed, verified and fully trusted).

Really want to leverage mTLS. I've had it working on an iPhone before (a couple of years ago, I think), but not sure if it's possible any longer.

#coordinatedstep #smallstep #nolunge
#rapierfencinglesson #handmedicine

Nice, #pihole is working flawlessly again including a fresh issued certificate from my recreated #smallstep #ca after I've ruined it successfully yesterday trying to post-init ssh.

There are only two #webservices without #ssl remaining, which I'll switch too. #pihole, my #nas and #opnsense is serving their pages using ssl already. #smallstep #pki #ca #certificateauthority #selfhosting #docker

The next addition for my #homelab will be a #selfhosted #docker #ca. I'll use #smallstep.