Getting my parents to add a CA to their android, iphone, windows laptop and macbook just so they can use my self hosted nextcloud sounds like an absolute nightmare.

The nightmare only intensifies for small businesses that allow their users to bring their own devices (yes, yes, sacrilege but that is how small businesses operate).

Not everything is a massive enterprise with an army of IT support personnel.

▲

crote a year ago | parent | next [-]

Rolling out LetsEncrypt for a self-hosted Nextcloud instance is absolutely trivial. There are many reasons corporations might want to roll their own internal CA, but simple homelab scenarios like these couldn't be further from them.

	▲	jillyboel a year ago \| parent \| next [-]
		Sure, which is what I do. But the point is that this is very much internal use and rolling my own CA for it is a nightmare.
	▲	GabeIsko a year ago \| parent \| prev [-]
		Would you suggest something? I do this, but I'm not sure I would call maintaining my setup trivial. Got in trouble recently because my domain registrar deprecated an API call and it ends up that broke the camel's back in my automation setup. Or at least it did 90 days later.

▲

mysteria a year ago | parent | prev | next [-]

I actually do this for my homelab setup. Everyone basically gets the local CA installed for internal services as well as a client cert for RADIUS EAP-TLS and VPN authentication. Different devices are automatically routed to the correct VLAN and the initial onboarding doesn't take that long if you're used to the setup. Guests are issued a MSCHAP username and password for simplicity's sake.

For internal web services I could use just Let's Encrypt but I need to deploy the client certs anyways for network access and I might as well just use my internal cert for everything.

▲

jillyboel a year ago | parent [-]

Personally I'd absolutely refuse to install your CA as your guest. That would give you far too much power to mint certificates for sites you have no business snooping on.

	▲	mysteria a year ago \| parent [-]
		Guests don't install my CA as they don't need to access my internal services. If I wanted to set up an internal web server that's accessible to both guests and family members I'd use Let's Encrypt for that.

▲

richardwhiuk a year ago | parent | prev [-]

Why are your parents on a corporations internal network?

	▲	jillyboel a year ago \| parent [-]
		What corporation are you talking about? Have you never heard of someone self hosting software for their family and friends? You know, an intranet.