Private PKI

Chapter 22

A CA of your own: private two-tier PKI

A private CA lets you issue certificates for internal systems under your own rules, built safely as an offline root plus an online issuing CA with clear policies and templates.

Chapter 21

Guarding the keys: HSMs and key ceremonies

A CA is only as trustworthy as its private keys, so they live in certified hardware, are created in witnessed ceremonies and are used only under multi-person control.

Chapter 12

Who do we trust? CAs, trust stores and self-signed certificates

Every client trusts only the root certificates in its own trust store, so a certificate is accepted only if its chain ends at one of them; being self-signed earns nothing.

Chapter 23

Both sides show ID: mutual TLS

In mutual TLS the client also proves who it is, with a certificate and a signature from its private key, so both ends are authenticated before any data flows.

Chapter 25

Machines with passports: device identity

A device certificate, installed at the factory with its private key locked in secure hardware, lets a machine prove what it is and who made it, for its whole life.

How to run a small private CA with step-ca (lab)

You will have a lab CA running smallstep's step-ca that issues and renews 24-hour certificates, speaks ACME, and refuses names outside your lab domain.

How to build a test CA with OpenSSL (lab only)

You will have a two-tier test CA built with openssl ca: a root, a name-constrained issuing CA, server and client certificates, a revocation and working CRLs.

How to trust a private root CA on Windows

Your Windows computer, or a whole fleet, trusts your organisation's private root CA, and you know which apps still need their own setting.

How to trust a private root CA on Linux

Your Linux server, desktop or container image trusts your organisation's private root CA system-wide, and you know which programs keep their own list.

How to trust a private root CA on macOS

Your Mac, or every managed Mac, trusts your organisation's private root CA in the System keychain, and you know which apps need their own setting.

How to add a CA to a Java trust store (cacerts)

Your Java program trusts your private root CA, either through the JDK's cacerts or through its own trust store, and you have proved it with a real connection.

How to set up mutual TLS (nginx and curl)

You will have an nginx endpoint that accepts only clients holding a certificate from your own client CA, lets in only the clients you name, and is tested with curl.

How to use SSH certificates instead of known_hosts

You will have OpenSSH host and user certificates signed by your own CAs, so clients trust servers without first-use prompts and servers trust short-lived user certificates.

Tool

Chain checker

Paste a chain and see which link is missing, expired or out of order.

Tool

CSR decoder

Check a certificate signing request before you send it to a CA.

Tool

Certificate decoder

Paste a PEM certificate and read every field in plain words.