daan/runelab-ca
1
0
Fork 0
Code Issues Activity

Compare commits

base: daan:9fedaa045e00d3aa9cd06c9b450bae3bca0e472b
Branches Tags
daan:main
...
compare: daan:0c00cb0c2b166212df067062d710e3e980f0bf04
Branches Tags
daan:main

2 commits
9fedaa045e ... 0c00cb0c2b

Author SHA1 Message Date
Daan Boerlage
0c00cb0c2b
readme formatting 2024-02-12 21:08:18 +01:00
Daan Boerlage
73ecdaf6fe
Remove the note about the airgapped system precaution, this is no longer true because the key would have to leave the bank vault 2024-02-12 21:07:04 +01:00
1 changed files with 12 additions and 10 deletions
Show stats Expand all files Collapse all files

22
readme.md
View file

@ -3,26 +3,28 @@
A certificate authority for the HomeLab. A certificate authority for the HomeLab.
The setup was mostly done by following these two guides: The setup was mostly done by following these two guides:
* [Jamie Nguyen's OpenSSL CA guide](https://jamielinux.com/docs/openssl-certificate-authority/introduction.html)
* [Mour's](https://github.com/mylamour) [blog post Jamie's guide using an HSM](https://github.com/mylamour/blog/issues/80) - [Jamie Nguyen's OpenSSL CA guide](https://jamielinux.com/docs/openssl-certificate-authority/introduction.html)
- [Mour's](https://github.com/mylamour) [blog post Jamie's guide using an HSM](https://github.com/mylamour/blog/issues/80)
## Notes of precaution ## Notes of precaution
* The root key is a yubikey kept in a physical vault at a bank in Switzerland. - The root key is a yubikey kept in a physical vault at a bank in Switzerland.
* All signings are done on an airgapped machine in a live-boot environment.
* This repo is transferred on and off the signing machine with a regular usb drive.
## Setup ## Setup
### Required Software ### Required Software
* OpenSSL - OpenSSL
* libp11 - libp11
* [YKCS11](https://developers.yubico.com/yubico-piv-tool/YKCS11/) - [YKCS11](https://developers.yubico.com/yubico-piv-tool/YKCS11/)
*[AUR Link](https://aur.archlinux.org/packages/ykcs11-p11-kit-module) - [AUR Link](https://aur.archlinux.org/packages/ykcs11-p11-kit-module)
**macOS note:** openssl installed via homebrew does not pickup on libp11, you need to manually copy the pkcs11 library (update the versions): **macOS note:** openssl installed via homebrew does not pickup on libp11, you need to manually copy the pkcs11 library (update the versions):
`cp /opt/homebrew/Cellar/libp11/0.4.12/lib/engines-3/pkcs11.dylib /opt/homebrew/Cellar/openssl@3/3.2.1/lib/engines-3/`
```sh
cp /opt/homebrew/Cellar/libp11/0.4.12/lib/engines-3/pkcs11.dylib /opt/homebrew/Cellar/openssl@3/3.2.1/lib/engines-3/
```
### Environment Variables ### Environment Variables