Computing/Running my own CA - Revision history

Cricalix at 17:33, 12 May 2026

2026-05-12T17:33:34Z

Cricalix: /* Synology */

2023-12-10T15:24:16Z

Synology

← Older revision		Revision as of 15:24, 10 December 2023
Line 48:		Line 48:
	# Copy the cert to /var/db/ca-certificates, named .crt, 0644		# Copy the cert to /var/db/ca-certificates, named .crt, 0644
	# Run update-ca-certificates.sh		# Run update-ca-certificates.sh
	# Grab acme.sh from Github - <code>wget <nowiki>https://github.com/acmesh-official/acme.sh/archive/master.tar.gz</nowiki></code>		# Grab acme.sh from Github
	# Install to /usr/local/share/acme.sh/ - <code>./acme.sh --install --nocron --home /usr/local/share/acme.sh --accountemail "acme@home.arpa"</code>		## <code>wget <nowiki>https://github.com/acmesh-official/acme.sh/archive/master.tar.gz</nowiki></code>
	# Piggyback on the DSM Let's Encrypt setup in nginx, and run <code>/usr/local/share/acme.sh/acme.sh --issue --home /usr/local/share/acme.sh -d vault.home.arpa --server <nowiki>https://vault.home.arpa:9000/acme/acme/directory</nowiki> --webroot /var/lib/letsencrypt ~~--days 90~~</code>		# Install to /usr/local/share/acme.sh/
	# Set SYNO_Username, SYNO_Password		## <code>./acme.sh --install --nocron --home /usr/local/share/acme.sh --accountemail "acme@home.arpa"</code>
	# <code>/usr/local/share/acme.sh/acme.sh --deploy --home /usr/local/share/acme.sh -d vault.home.arpa --deploy-hook synology_dsm</code>		# Piggyback on the DSM Let's Encrypt setup in nginx, and run
			## <code>/usr/local/share/acme.sh/acme.sh --issue --home /usr/local/share/acme.sh -d vault.home.arpa -d jellyfin.home.arpa -d lidarr.home.arpa -d sonarr.home.arpa -d radarr.home.arpa -d erddap.home.arpa --server <nowiki>https://vault.home.arpa:9000/acme/acme/directory</nowiki> --webroot /var/lib/letsencrypt</code>
			# Set SYNO_Username, SYNO_Password in the shell environment
			# Deploy the main name
			## <code>/usr/local/share/acme.sh/acme.sh --deploy --home /usr/local/share/acme.sh -d vault.home.arpa --deploy-hook synology_dsm</code>
	# Add a Task Scheduler entry to run <code>/usr/local/share/acme.sh/acme.sh --cron --home /usr/local/share/acme.sh/</code> frequently. step-ca defaults to 24 hours, so every 4 hours should ensure the certificate stays updated. With a 1 month renewal, this could be weekly.		# Add a Task Scheduler entry to run <code>/usr/local/share/acme.sh/acme.sh --cron --home /usr/local/share/acme.sh/</code> frequently. step-ca defaults to 24 hours, so every 4 hours should ensure the certificate stays updated. With a 1 month renewal, this could be weekly.
	# Add a Task Scheduler entry to run <code>/usr/local/share/acme.sh/acme.sh --deploy --home /usr/local/share/acme.sh -d vault.home.arpa --deploy-hook synology_dsm</code>		# Add a Task Scheduler entry to run
			## <code>/usr/local/share/acme.sh/acme.sh --deploy --home /usr/local/share/acme.sh -d vault.home.arpa --deploy-hook synology_dsm</code>
	## Without it, the cron schedule will happily regenerate the certificate, but it won't get installed when it expires.		## Without it, the cron schedule will happily regenerate the certificate, but it won't get installed when it expires.

Cricalix at 15:22, 10 December 2023

2023-12-10T15:22:06Z

← Older revision		Revision as of 15:22, 10 December 2023
Line 11:		Line 11:
	# Export out the root CRT file, will need it for trust everywhere		# Export out the root CRT file, will need it for trust everywhere
	## <code>certs/root_ca.crt</code>		## <code>certs/root_ca.crt</code>
			An existing acme configuration can have the default duration extended by setting a parameter in ca.json.

			"claims": {
			"defaultTLSCertDuration": "730h0m0s",
			...
			},

	== Deploy ==		== Deploy ==

Cricalix: /* Troubleshooting */

2023-12-10T15:16:01Z

Troubleshooting

← Older revision		Revision as of 15:16, 10 December 2023
Line 122:		Line 122:

	Root-caused - hadn't provided an outside-of-docker store for secrets etcetera, so an upgrade of the image lost all the generated configuration.		Root-caused - hadn't provided an outside-of-docker store for secrets etcetera, so an upgrade of the image lost all the generated configuration.

			Other root-caused - acme.sh has cached credentials for the certificate, and now that account doesn't exist either. Happens when the filesystem resets post upgrade, and after restoring the acme provider.

	It's easily fixed by re-adding the provisioner to the Step CA setup, but then a whole new set of CA certs may need distributing - I had to do this at least, and the dates on the certs had changed. Without doing this, Firefox will show SEC_ERROR_BAD_SIGNATURE.		It's easily fixed by re-adding the provisioner to the Step CA setup, but then a whole new set of CA certs may need distributing - I had to do this at least, and the dates on the certs had changed. Without doing this, Firefox will show SEC_ERROR_BAD_SIGNATURE.

Cricalix: /* Troubleshooting */

2023-12-02T08:11:38Z

Troubleshooting

← Older revision		Revision as of 08:11, 2 December 2023
Line 120:		Line 120:
	== Troubleshooting ==		== Troubleshooting ==
	At some point, my ACME provisioner vanished. This caused HomeAssistant's Caddy2 docker no end of grief, because it couldn't renew any more. The error message on the client side is very perplexing - <nowiki>urn:ietf:params:acme:error:accountDoesNotExist</nowiki> / "account does not exist". It's not saying that the email identifier of the '''client''' doesn't exist, but that the '''provisioner''' doesn't exist.		At some point, my ACME provisioner vanished. This caused HomeAssistant's Caddy2 docker no end of grief, because it couldn't renew any more. The error message on the client side is very perplexing - <nowiki>urn:ietf:params:acme:error:accountDoesNotExist</nowiki> / "account does not exist". It's not saying that the email identifier of the '''client''' doesn't exist, but that the '''provisioner''' doesn't exist.

			Root-caused - hadn't provided an outside-of-docker store for secrets etcetera, so an upgrade of the image lost all the generated configuration.

	It's easily fixed by re-adding the provisioner to the Step CA setup, but then a whole new set of CA certs may need distributing - I had to do this at least, and the dates on the certs had changed. Without doing this, Firefox will show SEC_ERROR_BAD_SIGNATURE.		It's easily fixed by re-adding the provisioner to the Step CA setup, but then a whole new set of CA certs may need distributing - I had to do this at least, and the dates on the certs had changed. Without doing this, Firefox will show SEC_ERROR_BAD_SIGNATURE.

Cricalix: /* Troubleshooting */

2023-11-19T13:46:02Z

Troubleshooting

← Older revision		Revision as of 13:46, 19 November 2023
Line 121:		Line 121:
	At some point, my ACME provisioner vanished. This caused HomeAssistant's Caddy2 docker no end of grief, because it couldn't renew any more. The error message on the client side is very perplexing - <nowiki>urn:ietf:params:acme:error:accountDoesNotExist</nowiki> / "account does not exist". It's not saying that the email identifier of the '''client''' doesn't exist, but that the '''provisioner''' doesn't exist.		At some point, my ACME provisioner vanished. This caused HomeAssistant's Caddy2 docker no end of grief, because it couldn't renew any more. The error message on the client side is very perplexing - <nowiki>urn:ietf:params:acme:error:accountDoesNotExist</nowiki> / "account does not exist". It's not saying that the email identifier of the '''client''' doesn't exist, but that the '''provisioner''' doesn't exist.

	It's easily fixed by re-adding the provisioner to the Step CA setup, but then a whole new set of CA certs may need distributing - I had to do this at least, and the dates on the certs had changed.		It's easily fixed by re-adding the provisioner to the Step CA setup, but then a whole new set of CA certs may need distributing - I had to do this at least, and the dates on the certs had changed. Without doing this, Firefox will show SEC_ERROR_BAD_SIGNATURE.

Cricalix at 13:45, 19 November 2023

2023-11-19T13:45:07Z

← Older revision		Revision as of 13:45, 19 November 2023
Line 117:		Line 117:
	# Use the letsencrypt add-on for HA, and specify the CA crt in the configuration. Have to apply https://github.com/home-assistant/addons/issues/2713<nowiki/>'s fix or things fail with error code 6.		# Use the letsencrypt add-on for HA, and specify the CA crt in the configuration. Have to apply https://github.com/home-assistant/addons/issues/2713<nowiki/>'s fix or things fail with error code 6.
	# Use the step-client add-on for HA. This got the root CA crt copied over, but didn't help with anything else really. Easier to just copy the certificate by hand.		# Use the step-client add-on for HA. This got the root CA crt copied over, but didn't help with anything else really. Easier to just copy the certificate by hand.

			== Troubleshooting ==
			At some point, my ACME provisioner vanished. This caused HomeAssistant's Caddy2 docker no end of grief, because it couldn't renew any more. The error message on the client side is very perplexing - <nowiki>urn:ietf:params:acme:error:accountDoesNotExist</nowiki> / "account does not exist". It's not saying that the email identifier of the '''client''' doesn't exist, but that the '''provisioner''' doesn't exist.

			It's easily fixed by re-adding the provisioner to the Step CA setup, but then a whole new set of CA certs may need distributing - I had to do this at least, and the dates on the certs had changed.

Cricalix: /* HomeAssistant */

2023-11-19T12:44:44Z

HomeAssistant

← Older revision		Revision as of 12:44, 19 November 2023
Line 27:		Line 27:
	tls acme@home.arpa {		tls acme@home.arpa {
	ca <nowiki>https://vault.home.arpa:9000/acme/acme/directory</nowiki>		ca <nowiki>https://vault.home.arpa:9000/acme/acme/directory</nowiki>
	ca_root /ssl/ca.pem		ca_root /config/ssl/ca.pem
	}		}
	}		}

Cricalix: /* Synology */

2023-10-28T07:38:10Z

Synology

← Older revision		Revision as of 07:38, 28 October 2023
Line 48:		Line 48:
	# <code>/usr/local/share/acme.sh/acme.sh --deploy --home /usr/local/share/acme.sh -d vault.home.arpa --deploy-hook synology_dsm</code>		# <code>/usr/local/share/acme.sh/acme.sh --deploy --home /usr/local/share/acme.sh -d vault.home.arpa --deploy-hook synology_dsm</code>
	# Add a Task Scheduler entry to run <code>/usr/local/share/acme.sh/acme.sh --cron --home /usr/local/share/acme.sh/</code> frequently. step-ca defaults to 24 hours, so every 4 hours should ensure the certificate stays updated. With a 1 month renewal, this could be weekly.		# Add a Task Scheduler entry to run <code>/usr/local/share/acme.sh/acme.sh --cron --home /usr/local/share/acme.sh/</code> frequently. step-ca defaults to 24 hours, so every 4 hours should ensure the certificate stays updated. With a 1 month renewal, this could be weekly.
			# Add a Task Scheduler entry to run <code>/usr/local/share/acme.sh/acme.sh --deploy --home /usr/local/share/acme.sh -d vault.home.arpa --deploy-hook synology_dsm</code>
			## Without it, the cron schedule will happily regenerate the certificate, but it won't get installed when it expires.

	==== Dockers on Synology ====		==== Dockers on Synology ====

Cricalix at 07:14, 1 October 2023

2023-10-01T07:14:34Z

← Older revision		Revision as of 07:14, 1 October 2023
Line 59:		Line 59:
	# Save		# Save
	# Try the new name in a browser or whatever.		# Try the new name in a browser or whatever.
			-----
	=== Desktop ===		=== Desktop ===

	# For firefox, find the CA cert, add it to the local store		# For firefox, find the CA cert, add it to the local store
			-----
	=== Router ===		=== Router ===

Line 69:		Line 69:
	# Install the luci-app-acme UI; it pulls in acme.sh		# Install the luci-app-acme UI; it pulls in acme.sh
	# Delete existing configs		# Delete existing configs
	# Add new config pointing to IP address of vault as custom source		# Add new config pointing to IP address of vault as custom source, including the port
	# Hack the code to add --insecure to the curl call		# Hack the code to add --insecure to the curl call
	# Request name router.home.arpa		# Request name router.home.arpa
Line 91:		Line 91:
	option acme_server 'https://192.168.0.218:9000/acme/acme/directory'		option acme_server 'https://192.168.0.218:9000/acme/acme/directory'


			==== Errors ====

			* Curl error 35 - probably forgot the port number
			* Curl error 60 - probably forgot --insecure

			-----
	=== iOS ===		=== iOS ===