Edd<p>About a week later than planned, I finally have my blogpost on automating step-ca in my <a href="https://mastodon.eddmil.es/tags/HomeLab" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HomeLab</span></a>, using <a href="https://mastodon.eddmil.es/tags/Puppet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Puppet</span></a> to automatically setup, and ensure renewal of, short-lived ssh certificates on all my hosts.</p><p>The end result is that all my internal certificates, both SSH and X509 for TLS have lifespans < 48 hours, so I'm way ahead of the Browser CA Forum's 47-day-lifespan-by-2029-plan.</p><p>At least, that's the first half of the post; the second half is then me describing all the services that I can't control through puppet, and how I wrangled them into Supporting SSH certificates whether they wanted to or not. Including <a href="https://mastodon.eddmil.es/tags/Truenas" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Truenas</span></a>, <a href="https://mastodon.eddmil.es/tags/QNAP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>QNAP</span></a>, <a href="https://mastodon.eddmil.es/tags/Opnsense" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Opnsense</span></a>, <a href="https://mastodon.eddmil.es/tags/HomeAssistant" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HomeAssistant</span></a> and <a href="https://mastodon.eddmil.es/tags/Forgejo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Forgejo</span></a>/#Gitea. </p><p>It's mostly talking about SSH certs, but it also touches on issuing regular X509 certs for their web interface certificates, for the ones that don't support ACME properly (spoiler: that's most of them 😩)</p><p>Given this is probably of interest to maybe a dozen people on the Fediverse, it's probably not worth all the time I put into it, but on the plus side, I feel I understand how everything works incredibly well now, which will be useful going forward. (In before someone puts a comment here telling me how I could have fixed some of the problems I hit here much easier!)</p><p>Check it out, if it sounds at all interesting to you: <a href="https://i.am.eddmil.es/posts/ssh-certificates/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">i.am.eddmil.es/posts/ssh-certi</span><span class="invisible">ficates/</span></a></p>