49
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 14 Sep 2024
49 points (91.5% liked)
Firefox
17302 readers
120 users here now
A place to discuss the news and latest developments on the open-source browser Firefox
founded 4 years ago
MODERATORS
If you can't resist installing random shit on your CA server then sure. No attacker will really try to compromise a home CA so you really only have to worry about viruses which should be kept extremely far from the CA anyways. And obviously follow all other security precautions like good passwords or even passwordless with certificate login (remember that you have a CA server so you can easily issue authentication certificates and enroll them on a smart card or Yubikey)
The private key should also be in TPM (or a HSM like we do at work, but that's a bit extreme for home use) and be non-exportable. Managing access to the private key isn't really that hard, it should just never ever leave the CA server and you are pretty much good to go.
You can also do a two tier PKI with an offline CA and an issuing CA like I'm planning to do for an AD DS, AD CS, AD FS lab.
Personally I think wildcard certificates sound like a bigger security problem than a CA since that certificates will likely be placed on a lot of servers and if just a single one gets compromised the attacker can impersonate whatever subdomain they feel like. With a CA server you could issue individual certificates to each server/service
Private CA servers are very common and is actually a security positive. I'm not saying that everyone needs one at home, but you shouldn't be afraid to setup one if you want too.
I'm in a home environment. I don't have a TPM*, I don't have yubikeys. And no, certificates won't be placed on a lot of servers, as
That's perfectly fine for a home environment but don't act like having a proper PKI is a bad or insecure idea.
Also I would be surprised if your server doesn't have TPM unless it is very old.