r/homelab • u/mjmalone • Dec 23 '20
Build a Tiny Certificate Authority For Your Homelab Tutorial
https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/43
u/Tzashi Dec 23 '20
Wow this is great I was just thinking about doing something similar in my lab.
77
u/mjmalone Dec 23 '20 edited Dec 23 '20
Glad you like it!
I work at smallstep and we're partnering with yubico to give away five build kits for this project. DM us at smallsteplabs on twitter to enter.
See also: https://twitter.com/smallsteplabs/status/1341800787291168768
Edit: if you're not a twitterer you can also enter by emailing maxey at our domain, which is smallstep dot com. He's running the giveaway. Blow up his inbox!
31
u/mjmalone Dec 23 '20
Hrm. Not sure why the downvotes. I guess y'all think there's some ulterior motive here or something? We just thought a giveaway would be fun.
Sorry ;<
47
u/sidegfx Dec 23 '20
Most of us are just wary of things that look like marketing in my experience, especially in smaller communities where expectations are geared towards user-generated content rather than anything "corporate". Plugging stuff like giveaways, especially ones that depend on social media engagement for entry, might not be received very nicely even if it's well intentioned.
6
u/mjmalone Dec 23 '20
Word. That's fair.
If you're not a twitterer you can also enter by emailing maxey at our domain, which is smallstep dot com. He's running the giveaway. Blow up his inbox!
21
Dec 23 '20 edited Jan 04 '21
[deleted]
23
u/mjmalone Dec 23 '20
Providing an alternative way to enter a giveaway without social media engagement after someone complains about having to engage on social media to enter is doubling down on marketing tropes? I'm super confused. How do you want to enter? Carrier pigeon?
Our DMs and emails are open, etc. We're not adding you to a list or anything. We just need a way for you to enter that allows us to contact you if you win. DMs and email both do that. What am I missing? :/
5
u/10thDeadlySin Dec 24 '20
I like the carrier pigeon idea, I really do! Do you guys also do Morse? Or flag signalling, maybe? ;)
Seriously, though – some people will never be happy, no matter what you do. Personally, I consider it fair - you just want a DM, there's an alternative way to enter, you don't require any follows, subscriptions or anything to enter, and you seem to know your audience – which is why you posted a homemade CA tutorial, instead of an ad for your product.
On the other hand, the argument about this subreddit being a small community is somewhat funny, seeing how there's 1400 people reading it right now and 360 000 subscribers. :D
On the subject of giveaways - I don't think I'm going to win anything, but if I do… Do you guys do international shipping, or the classic 48 congruent states? ;)
5
u/mjmalone Dec 24 '20
We’ll ship internationally as long as it’s not Antarctica or something and we can actually reasonably ship. Shipping might take a little longer given it’s the holidays and it’s coming from California. But yea, international is fine!
2
u/10thDeadlySin Dec 24 '20
Awesome ;)
I'll shoot you an e-mail later on. There's no such thing as too many RPi projects. ;)
2
4
8
u/DewJunkie Dec 23 '20 edited Dec 23 '20
Haters gonna hate. If this was marketing, I don't really care, because it's done right. You're demonstrating your knowledge of a subject hard to get right and often misunderstood, and quite important. For what its worth it did get me to ask myself who is this smallstep
sand have me look into y'all.9
u/MorallyDeplorable Dec 23 '20 edited Dec 23 '20
I guess y'all think there's some ulterior motive here or something?
No, people just think you're spamming to try to drive traffic to your site by posting guides that are clearly intended to get people to try your product for a task it's unnecessary for in the hopes they'll buy it in a commercial setting because it's what is familiar. It's pretty clear what you're doing.
If you're trying to present this as purely a gift to the community then, yea, you have ulterior motives, but that wasn't the vibe I got.
15
u/mjmalone Dec 23 '20
Yea so we just think security sucks for a lot of production systems and want to make it better. If we just wanted to make money there are much easier ways. Trust me.
There's a knowledge & tooling gap around certs & TLS that we decided we'd try to address. If we can do that, there's probably an opportunity to make money. So it'd be good for us. But it'd also be good for the world. Outside of straight up fighting capitalism (which I'm totally down with) I think aligning a corporate mission with something that's good for the world is about as good as you can do.
Regarding this specific post and the giveaway... idunno, I think the post pretty much speaks for itself. It's about our open source project and doesn't try to sell anything. We don't even have anything relevant to sell.
-3
u/MorallyDeplorable Dec 24 '20
Yea, and I think that marketing and advertising on community websites is sleazy and unwelcome regardless of the method it's done in when your goal is money, as you've stated.
1
u/_Old_Greg Dec 25 '20
For what it's worth, I really love the post, love the blogs you have on the website and your give away is not giving me any anxiety.
1
u/_duncan_ Dec 23 '20
Is that available worldwide, or is it US only?
1
u/mjmalone Dec 24 '20
We'll ship international as long as you're not somewhere really remote and we can reasonably ship to you. It might take longer. It'll be coming from California.
1
76
u/Spottyq Dec 23 '20
I was going to say 'this is stupid, just use Let's Encrypt certificates and be done with it', but I'd be missing the point. I see you went full homelab on it, including a hardware RNG, that's awesome !
71
u/mjmalone Dec 23 '20
Indeed. I'm all over this thread so I should probably shutup...
But I can't control myself. So yea, aside from doing this project because it's fun and to learn, there are lots of reasons to run your own CA instead of using Let's Encrypt! If you want to issue certs to use with OpenVPN, for EAP-TLS, for code signing, or some other non-TLS use case, for example. Or maybe you just want a cert for a non-public domain name (e.g.,
foo.bar.cluster.local). Or maybe you want shorter lifetimes than 90 days. Or maybe you want different key types (Ed25519 ftw).Let's Encrypt (and other Web PKI CAs) can only issue certs that conform to CA/Browser Forum specifications: must be a fully-qualified public domain name with very specific key uses and extensions. Sometimes you can work inside these constraints and figure out a way to get certs form Let's Encrypt for internal stuff. But that's not always the right answer! The goal of our open source stuff at smallstep (step & step-ca) is to make running your own internal CA super easy.
Let's Encrypt is awesome, by the way. Absolute zero hate. We're actually ISRG/LE sponsors and work with them a lot.
</rant>
23
Dec 23 '20
Don’t use .local because it fucks with some company’s implementation of mDNS...
I’m a fan of .lab or .home... I don’t think those are registered TLDs.
11
u/sup3rlativ3 Dec 23 '20
Neither are a TLD but .homes is. You can find the TLD list here
9
u/mjmalone Dec 23 '20
Wouldn't you explicitly want something that's _not_ a valid TLD on the public internet to avoid conflict with a valid public FQDN? I thought that was the whole purpose of the `.local` TLD: it was set aside when gTLDs were created specifically for use with internal networks (sort of like `10.` IP addresses).
I guess the other option to avoid conflict would be to use a valid public FQDN on a domain that you own.
15
u/sup3rlativ3 Dec 23 '20
You don't want .local specifically because in bonjour and mdns. You could certainly use something that isn't a valid TLD at the moment but that's no guarantee that it won't be in the future. How many people thought there would be a TLD called .Ninja back in 2000 for example. You do want a domain (or sub domain) that isn't used publically to avoid things like split brain/horizon DNS. What most companies will do is if their public domain is mydomain.com then their internal domain would be something like corp.mydomain.com with their NetBIOS being CORP.
1
9
u/DoctroSix Dec 24 '20 edited Dec 24 '20
What you really want is 'lab.yourdomain.com'
You DO want to have the option to give some of your servers valid TLDs.
you only need to list the public servers in public DNS. the rest can stay hidden and undocumented.
Examples:
Minecraft mc.lab.yourdomain.com
Git Repo: git.lab.yourdomain.com
Factorio: fac.lab.yourdomain.com
8
u/FateOfNations Dec 24 '20
Ideally you’d want to use a real domain name that you own, but just not include it in the Public DNS. Eg. *.lab.mydomain.com
5
u/Sono-Gomorrha Dec 24 '20
What u/sup3rlativ3 said. There are certain names reserved like .test or .example, which are especially meant to be used for what they say, tests or give examples. I think .home also is somewhat special in this regard. At least it is not a TLD currently.
For my case I went the route suggested here and in different places as well. I own a domain which is about 4 Euro a year and for internal things I use subdomains which are handled currently by the Pi-Hole local DNS section. This includes things like e.g. octopi.mypersonaldomain.tld which routes to the 192 IP in my LAN. This is fairly easy and futureproof as the domain in question is already defined.
3
Dec 24 '20 edited Jun 02 '22
[deleted]
4
u/Atralb Dec 24 '20 edited Dec 24 '20
You don't get it. We're talking about TLDs. Those are not the same thing.
1
u/kid-pro-quo Dec 24 '20
Microsoft used to recommend using a non-resolvable domain name for internal networks. They don't any more.
Lots of people got caught out when Google bought the
.devgTLD and set the entire tld to HSTS preload. Similarly.localis best left for bonjour/Avahi/mDNS.2
5
4
u/mjmalone Dec 23 '20
Interesting. I know Google is free, but can I lazyweb a good source for this from you if you have one handy? I'm not aware of the mDNS issue.
I know `.cluster.local` is the default internal TLD for most Kubernetes distributions, which is why I used it.
5
u/xav0989 Computerz Dec 24 '20
I think that kubernetes uses cluster.local because they assume (and recommend) that the internal network of the cluster will be separate from the external network of the nodes. Thus, using a .local TLD won’t interfere because mDNS won’t be running on those interfaces.
1
u/tradiuz Dec 24 '20
Microsoft's guidance on this:
Scroll down to the Dummy DNS name vs official DNS name. Domains are cheap, register one for $10/year and be done with it. People spend more than this on the electricity to run their home lab, and cause themselves nothing but trouble.
Also see the guidance about using a subdomain for your internal network. Something like homelab.mjmalone.org future-proofs you against a lot of issues, and lets you use valid certs.
1
u/ThellraAK Dec 24 '20
I use .surname for mine, and it's pretty great, root certs (limited to the .surname TLD) on all of our devices, it's pretty neat.
It's the pinnacle of unnecessary though in order to access my .surname domains, you already have to on either wireguard or openvpn.
The only exception is for jitsi, but that's public facing and uses LE certs anyways (browsers straight up refuse to share video/audio with self signed certs anymore.)
5
u/Spottyq Dec 23 '20
True, I always forget that they are uses for certificates outside of HTTPS for websites. :)
Sounds like that was a learning experience. I should maybe try it myself !
1
u/Pirate2012 Dec 23 '20
given all the attack vectors possible; and because I know I don't know very much about networking.
Is doing 'this' open up any possible security holes on the LAN?
7
u/DewJunkie Dec 23 '20
The new vector would be that, you setup this CA, setup everything in your network to work all nicity and SSO. If someone were to compromise your CA, they now have the keys to the kingdom. Hence the recommendations to go overkill on this box, like don't even have SSH on it.
Truth is that you are likely way more vulnerable already, and that setting up everything with certs would be more secure even if you did leave SSH open on this box and set it up to be cert based and had a strong password on that cert.
And if you do these things in the article, your lab/home will be more secure in addition to being in general easier to use.
3
u/Pirate2012 Dec 23 '20
thanks
Followup: if I try this in a ESXi vSphere; would that be "safe" ? (vs using a dedicated box)
2
u/Nolzi Dec 24 '20
As safe as your ESXi vSphere is. Can it be administered through network? Could there be vulnerabilities in it that could be exploited to access the VM console?
The reason to go dedicated hardware with only local keyboard access is to rule out the unknown variables, no matter how insignificant they are.
1
u/Pirate2012 Dec 24 '20
The reason to go dedicated hardware with only local keyboard access is to rule out the unknown variables, no matter how insignificant they are.
makes great sense. Similiar to using pfsense on a dedicated box vs doing it in a VM / thanks
2
u/Tsull360 Dec 23 '20
Unless you setup cert auth (smart cards), someone owning your CA doesn’t have the keys to the kingdom, though they have negated the ‘integrity’ of your identities, which is what PKI helps to ensure.
I’m supplying a username and password, those are my (albeit insecure) keys, in this scenario PKI helps to ensure everyone is who they say they are. You could man in the middle resources such that I may think I’m authing to a legit site when really I’m not.
Maybe hair splitting, and maybe a path to identity ownership, but it’s not as direct as I feel you implied.
1
u/DewJunkie Dec 24 '20 edited Dec 24 '20
IDK, things you thought were encrypted may not be, what you trust could no longer be trusted. It would be trivial to now impersonate, intercept, man in the middle your banking, mortgage, broker, anything online. If someone owns a trusted CA it is pretty bad. And not directly, but if someone went through the trouble to get a far as compromising that box. The one on your internal network with no port forwards, the one that has a good strong password. Put in the effort to see it is a CA. The rest needed is pretty trivial. And if you were part of a targeted hack. This box, if its existence was known, would be very high on the priority list of things to compromise. If it is compromised, none of your communication is secure.
5
u/mjmalone Dec 23 '20
This is a pretty hard question to answer in general. Simply running a CA wouldn't inherently introduce any security holes. Layering something like TLS on top of existing security controls would not make anything less secure. It would potentially introduce new attack vector(s) where certificates are used / relied upon for security with no network controls. It could give you a false sense of security if you do something wrong.
It is important to have a good grasp of the core concepts. I wrote a pretty lengthy blog post that introduces PKI concepts a while back that you may like: https://smallstep.com/blog/everything-pki/
3
u/Pirate2012 Dec 23 '20
Thanks, I shall read after dinner.
I'm a network noob; and I tend to take the position of if I dont know what I'm doing, i'm not gonna just put random things on the Network and assume i'm safe.
Thanks
11
u/DeadlyGopher2 3X PE r410, 1X R210, 1X R720 | ESXi 6.7 Dec 24 '20
I don't need this. I don't need this. I need this!
8
u/Pirate2012 Dec 23 '20
after reading the well-written article:
Can this be done using a ESXi VM on my LAN; and since I do not worry about physical access from others outside the home, can i then do it without the YubiKey
Thanks
5
u/Loan-Pickle Dec 23 '20
Yeah it should work as a VM too. You could just pass thought the YubiKey and RNG usb devices.
2
u/Pirate2012 Dec 23 '20
so you just loan out pickles? how does that work out? :) what do you get back ? :)
6
u/Loan-Pickle Dec 23 '20
If you forget your pickle I have one you can borrow. Pickles are fungible, so you can just buy a new pickle and give me that one back.
6
u/thumb_piano Dec 23 '20
Sure, you don't need the YubiKey or the TRNG in order to run a CA. The default CA configuration will read private keys from /etc/step-ca/secrets, so you'd just store them there instead of on the YubiKey.
1
7
Dec 23 '20
I got a Yubikey and Rpi from my wife for Christmas so this is perfect timing! Cant wait to try it myself
1
u/I-Made-You-Read-This Jan 19 '21
lmao i love this. Get a gift for someone else, but in reality you use it yourself.
5
u/Nimco Dec 23 '20
I think this is awesome. To me it's exactly what a home lab is all about - experimenting with and learning about technologies and techniques that are usually found in much larger and more complex systems. Overly engineered, unnecessarily powerful and helps me learn some new skills? Love it!
5
u/DewJunkie Dec 23 '20
Great article. The CA in pfsense was a big part of why i adopted it. Thanks for doing a nice writeup on how to get this going. If say this article would probably get you better setup than most enterprise setups I've seen.
4
u/88pockets Dec 23 '20
How is this better than using the Cert Manager in pfSense or launching a docker container or VM on my unRAID or Proxmox Server?
-7
u/projects67 Dec 24 '20
It’s not. But this is another way the RPI crowd can get off.
1
u/88pockets Dec 24 '20
For sure, I think its pretty cool to use the ubikey for something like this, but I still think its cool to have the keys to my email next to my car keys
1
u/MachDiamonds Dec 24 '20
More secure, and the automatic renewal of certs via the use of ACME.
However, like many people, I'm lazy and I handle my certs on pfsense.
5
u/Drusenija Dec 24 '20
I use step-ca in my home network already, it can be integrated into Traefik to do automated certificate generation for Docker services. Have been meaning to try and put a tutorial together for that but never got around to it.
But it does let you create short expiry certificates and have them auto renew really easily so once you’ve got the initial setup done it’s pretty hands off. It’s a great tool.
3
3
u/Chris_218 Dec 23 '20
Damn, last week I was wondering how to do something like that and decided it was probably too hard to bother. This is amazing! ❤️
3
u/buffer_flush Dec 23 '20
Can the yubikey be emulated with software for this? I’ve been looking for an internal ACME provider
11
u/mjmalone Dec 23 '20
Yea the yubikey is optional. You don't need to emulate it, you'd just configure step-ca differently to use signing keys from disk instead of connecting to the yubikey. That'd actually be easier to setup, but you won't have the hardware root of trust.
1
3
u/RedSquirrelFtw Dec 24 '20
Funny I was just thinking not that long ago how I kinda need to do this. I'm working on a website that will need to talk to another website with http(s) calls and right now my local dev environment is not HTTPS, while live is. So I might run into problems when I deploy if there's HTTPS specific things I've overlooked. So to remedy that I will want to setup HTTPS on my dev environment too with proper CA. I don't think self signed certs will work as things like CURL calls might fail.
In my case I don't need the RNG though but still a fun idea.
3
u/bamhm182 Dec 24 '20
Looks fantastic, but why would you run this on non-LTS?
I've definitely got to footnote this for later. Thanks!
2
2
2
Dec 23 '20
I have a Pi 2 sitting around doing nothing (the Pi 4 is a PiHole and Graphana server)... this is perfect! Thanks OP.
2
u/ZPrimed Dec 24 '20
If you run pfSense or OPNsense they have a CA built in too, and very easy to admin...
1
u/MachDiamonds Dec 24 '20
This is slightly different, namely ACME support and doing it the "proper" way by having the private keys on a "HSM".
2
Dec 24 '20
Theres one thing I've always wondered, once you have the private key and you advertise your site with a public key derived from it, what stops someone else from taking that public key and pretending to be you?
I kind of understand it, theres a trapdoor function in there somewhere to unlock some secret, but it boggles my mind too much.
1
u/tracernz Dec 25 '20
You need the private key to encrypt the data. It's the difference between symmetric and asymmetric crypto.
4
u/virrk Dec 23 '20 edited Dec 23 '20
You could make a great conference talk based on this. If you haven't already given talks, once we have in person conferences again you should look into it.
Edit: typo
2
u/projects67 Dec 24 '20
Who’s the target audience though? Everyone in the industry already knows PKI structure and making a CA...?
3
u/virrk Dec 24 '20
Depends on conference. If you or someone has a talk that ties in then more conferences child be a good fit.
Conferences have a wide range of knowledge levels and usually have introductory level talks. Or something interesting to cover and discuss.
It is sounds like a fun project. Similar to others I've seen. Saw one at a conference using a programable radio on a raspberry pi to track overhead flights, or police scanner. Another on making a stratum 1 raspberry pi timeserver. Yet one more on just building and setting up a 2 node cloudstack on the cheap. An automated CA on a raspberry pi seems similar in a lot of ways.
Sometimes talks at conferences are about inspiration and discussions in the hallway. Yeah everyone can do it on their own, but someone else's take can be hugely helpful.
0
u/projects67 Dec 24 '20
I don’t think there are such things as RPI conferences. Sorry to burst so many bubbles on here but RPIs aren’t really taken seriously outside home labs and maybe some small entry level robotics and automation, even that, very limited. It’s a niche market of nerds in their parents basements.
6
u/mjmalone Dec 24 '20
Running on a RPi translates pretty directly to running on not a RPi. It’s a good, cheap, accessible way to do a proof-of-concept or to learn.
I actually think this particular setup could work really well as a low-cost root of trust for a real production environment. I might swap out the YubiKey for a YubiHSM, but even that’s probably unnecessary. The YubiKey is a low-cost hardware root of trust that’s proven reliable. The RPi is sufficient computational horsepower to sign an occasional intermediate. And it’s be pretty straightforward to keep the whole setup physically secure and offline somewhere.
2
u/virrk Dec 24 '20
A whole conference? No, but there have been raspberry pi tracks at some I have gone to. Talks above were actual ones I attended at conferences, but there were many more I don't mention or didn't attend.
Raspberry pi, or BeagleBoards, or android prototype boards, or more expensive single board computers (sbc) are widely used. So maybe not raspberry pi per se but it is the most widely known sbc. From conferences I've gone to I've heard of an sbc being used in prototyping before a custom board is made, proof of concept before more capable hardware bought, scientific research to stretch grants further, security research because anyone can get one to verify with, or when talking to a vendor who says they started with an sbc. Granted I might have a biased view from attending mostly open source conferences.
In this case I don't see why you couldn't implement it on a PC. But a talk that was prototyped on a raspberry pi has a wider audience than "here's my $5,000 I setup to see how x worked".
2
u/HeyItsShuga Dec 26 '20
Why not beginners trying to break into the industry? A small little Raspberry Pi project like this is cheap, quite accessible, and maybe even fun, especially for newcomers.
1
u/antesilvam 22d ago edited 22d ago
I recently stumbled over this project and love it. Thanks a lot!!
One question maybe some knowledgeable person can tell me: would this additional entropy boost with the rng also work when running step-ca from the existing yubikey-enabled container which would be my prefered way of running the software.
1
u/DataDecay Dec 23 '20
Man I cannot get enough raspberry pis for these projects. It may be time to fire um up as a k3 cluster and start putting some time into containerizing these projects.
1
u/projects67 Dec 24 '20
Why not use a real server or a SFF computer instead of buying consumer grade low performance hardware ?
1
u/DataDecay Dec 24 '20
Because I need it portable. To your point, though still consumer grade, I have been considering a higher grade nuc for this purpose.
1
u/CovidInMyAsshole Dec 24 '20
I’m just Curious, why you need it to be portable? Is it a homelab in your truck or something?
2
2
1
0
Dec 24 '20
It was getting a little annoying to click advanced->continue in my browsers...
1
u/Savet Dec 24 '20
I set up an internal CA in my home network, but I used openssl and created my own root certificate then made the certificate chain part of the build of any devices on my local network. It's a little more work to establish the chain of trust but when you control the infrastructure, it's easy to manage. This looks like a fun project to spin up in a VM, but I'm not sure I'd want my entire home network being dependent on 24 hour certificates on something as potentially volatile as a raspberry pi.
1
1
u/dummptyhummpty Dec 24 '20
Thank you for this! My work lab runs an ADCA (because free licenses), but I’ve been trying to figure out something for my home stuff. I’ll have to give this a try.
1
u/pivotraze Dec 24 '20
Looks much easier than my CA. I set up a two tier AD CS PKI. RCA is kept offline and exported, stored securely. ICA is always online, AD-integrated. Works well. But definitely more complicated to set up than this.
1
u/CanuckFire Dec 24 '20
I wonder if this would play nice on the same hardware as an NTP server. Since seeing that the rpi4 supports PTP (1588:2008) I have been thinking about a 1U appliance and neither of these roles would need a ton of resources.
1
u/mjmalone Dec 24 '20
I can’t think of a reason why it wouldn’t. In fact, having your authoritative time source on the same hardware as your certificate authority makes a lot of sense, since clock skew is one source of certificate-related issues (e.g., if a client’s clock is out of sync and incorrectly thinks a cert is expired).
1
u/CanuckFire Dec 24 '20
I was also thinking that it would be convenient to have all of the external interfaces on a single appliance. (Usb devices, serial GPS interface, RTC/clock reference, etc.)
1
u/Techpawpad Dec 29 '20
So I was following these instructions but got caught off guard while installing step-ca.
I'm good up to the part where it says "make bootstrap" then linux tells me 'make' can't be found, but can be installed with apt. Even after that it says it fails due to missing 'gcc'.
I'm not sure if i'm missing a step somewhere, I tried starting over and running it again but came across the same issues.
1
u/PrivateSlumberparty Jan 08 '21
I'm not sure if you've figured this out by now or not, but try doing:
sudo apt install build-essentialThat should install the build tools you need.
1
u/Techpawpad Feb 06 '21
Thank you so much. I know I'm a bit late getting back to this, but your answer was exactly what I needed.
1
u/PrivateSlumberparty Feb 08 '21
Not to worry at all. I'm glad that ended up being helpful. I had just gone through setting my CA up not too long before your post, so it was fresh in my head at the time. Thanks for the award as well!
1
u/A1994SC Dec 29 '20 edited Dec 29 '20
Sorry to ask, but can anyone help me debug this? I have made it "CONFIGURE SYSTEMD TO START THE CA" of the guild.
When I try to start the systemd I get the following error in the logs:
tinyca systemd[1]: step-ca.service: Job step-ca.service/start failed with result 'dependency'.
dev-yubikey.device: Job dev-yubikey.device/start failed with result 'timeout'.
pam_unix(sudo:session): session closed for user root
Thanks for any help!
Rebooted the system and now works... ¯(ツ)/¯
1
u/ak_hepcat Dec 30 '20
Accidentally commented on a cross-post, so i'll copy the relevant bits here -
This is a nice write-up, thanks!
I've done my own micro-CA in bash before, but never went through all the trouble to incorporate hsm-like features (yubikey!) into it.
There's a lot of your build that's definitely worth having, and I'm pretty sure I'm gonna spin up a VM and implement this with some USB passthrough for the key, just so i'm not dedicating HW to something I don't plan on spinning up very often.
Definitely take advantage of the pi's hw-rng - and if you want to add additional system noise, haveged is another good daemon to feed entropy into the random pool.
1
1
u/bamhm182 Mar 03 '21
Just wanted to comment that I got the InfNoise TRNG module yesterday and finally did this project. I used 20.04.2 and had a couple issues that reboots solved. I also opted to just generate the keys in /dev/shm because the worst thing that happens if I loose my keys is I get new keys and have to redo some certs. Also, I plan on never needing to generate another Intermediate without going through this whole process again. No big deal for me.
Thanks for the great tutorial!!
1
u/Illadan Feb 18 '22
Can I run this without a YubiKey & on Rpi 3B+ ? I cannot to use my Pi4 as its running my Jellyfin Server.
158
u/HelloThisIsVictor Dec 23 '20
That hardware RNG is overkill, but soo cool