scep

> You need a PKI which exposes a SCEP endpoint (ejbca or dogtag supports this). Uhh... > [...] ejbca [...] Now you have two problems. What I mean is, if you’ve been already running EJBCA for whatever reason then this is perhaps reasonable, but if your current setup is at the level of typing `openssl req` into a terminal (whether that’s a good idea or not), it sounds like a lot of additional complexity. (Can’t say anything about dogtag.) I’ve been waiting forever for somebody to add an ACME backend to the Go SCEP library[1], but it doesn’t look like that has happened. In the meantime it includes a fairly competent standalone CA server at the abovementioned invoke-openssl-by-hand level. Note that SCEP basically requires a trusted network, though, from what I remember. [1] https://github.com/micromdm/scep

Thats a great point. As a Go developer I always try to make sure that there's a linux and binary for my small projects released on github. I'm surprised more Go devs don't do this. The toolchain makes it very easy to update releases. You can also use ldflags to set the current git revision and branch into the project. Here's an example release.sh I have in most of my projects https://github.com/micromdm/scep/blob/master/cmd/scepclient/...