For self hosting at least, having your own CA is a pain in the ass to make sure everything is safe and that nobody except you has access to your CA root key.
I’m not saying it’s not doable, but it’s definitely a lot of work and potentially a big security risk if you’re not 100% certain of what you’re doing.
Just use only VPN to access your services behind the reverse proxy, if you want prevent unauthorised connections.
CA certificates are not here to prevent someone accessing a site, they are here, so that you can be sure, that the server you are talking to is really the one belonging to the domain you entered and to establish a tunnel in order to send the API calls (html, css, javascript etc.) and answers encrypted.
That’s the problem, if anyone somehow gets your root CA key, your encryption is pretty much gone and they can sign whatever they want with your CA.
It’s a lot of work to make sure it’s safe in a home setup.
You can just issue new certificates one per year, and otherwise keep your personal root CA encrypted. If someone is into your system to the point they can get the key as you use it, there are bigger things to worry about than them impersonating your own services to you.
You can set up your own CA, sign certs and distribute the root to every one of your devices if you really wanted to.
Yeah I know about that, I’ve done it. It’s just a PITA to do it even slightly carefully.
That sounds like a bad idea, you would need your CA and your root certs to be completely air gapped for it to be even remotely safe.
Why?
That’s a rather absolutist claim when you don’t know the orgs threat model.
For self hosting at least, having your own CA is a pain in the ass to make sure everything is safe and that nobody except you has access to your CA root key.
I’m not saying it’s not doable, but it’s definitely a lot of work and potentially a big security risk if you’re not 100% certain of what you’re doing.
No worse than protecting your ssh key. Just keep it somewhere safe.
Just use only VPN to access your services behind the reverse proxy, if you want prevent unauthorised connections.
CA certificates are not here to prevent someone accessing a site, they are here, so that you can be sure, that the server you are talking to is really the one belonging to the domain you entered and to establish a tunnel in order to send the API calls (html, css, javascript etc.) and answers encrypted.
That’s the problem, if anyone somehow gets your root CA key, your encryption is pretty much gone and they can sign whatever they want with your CA.
It’s a lot of work to make sure it’s safe in a home setup.
You can just issue new certificates one per year, and otherwise keep your personal root CA encrypted. If someone is into your system to the point they can get the key as you use it, there are bigger things to worry about than them impersonating your own services to you.