MImike978·Oct 22, 2024
How does this compare with smallstep step-ca certificates?
https://github.com/smallstep/certificates
In Just want simple TLS for your .internal network?smallstep
certificates
Go2019–2024
smallstep / certificates
certificates
🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
13Distinct people
23Mentions
1Explicit recommenders
9.1KGitHub stars
What to know before exploring
What it is
🛡️ A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
I've been doing this for a while with SmallStep CA: https://github.com/smallstep/certificates It's a bit of a pain to load a cert onto every device (easier with stuff like…
gclawes used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- smallstep/cli · linked in 3 of the same discussions
- cloudflare/cfssl · linked in 2 of the same discussions
- hashicorp/vault · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 12:03:30 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year23 dated mentions
Observed mentions: 2019-01-19 09:31:46 UTC to 2024-10-22 22:03:29 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 7 | 3 | 4 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 8 | 1 | 7 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 4 | 0 | 4 |
What Hacker News says
4 sourcesI've been doing this for a while with SmallStep CA: https://github.com/smallstep/certificates
It's a bit of a pain to load a cert onto every device (easier with stuff like Ansible if you have a bunch of linux devices), but manageable. And it lets me do proper trusted TLS for a lot of stuff that would otherwise be self-signed.
edit: It's also just a fun homelab project to see what it's like to run a full production-ish PKI setup.
One thing I recommend is to add X509v3 Name Constraints extensions to your root CA if you go down this path. It prevents the CA from being abused to MITM you for other domains (at least for browsers/clients that respect names constraints)
X509v3 Name Constraints: critical
Permitted:
DNS:home.arpa
DNS:.home.arpa
IP:10.0.0.0/255.0.0.0
IP:172.16.0.0/255.240.0.0
IP:192
Read the rest
.168.0.0/255.255.0.0
Just run FreeRADIUS yourself. If you need your own PKI to generate certs in a manageable way, there is OPNsense [0] or smallstep's FOSS step-ca [1].
Friends don't let friends delegate AAA to an external provider like Smallstep or SSO to Okta. While outsourcing to a third party is fine for a limited test, it's not fine for anything enduring.
Once upon a time, when open, spoofable WiFi was the norm, there was a collective WiFi sharing app that took control of retail WiFi routers with WPA1 enterprise RADIUS support called Radiuz. [2]
0. https://opnsense.org
1. https://github.com/smallstep/certificates
2. https://web.archive.org/web/20040617153148/http://radiuz.net...
In WPA3 Enterprise 192-bit mode at homeYou can roll your own with https://github.com/smallstep/certificates. We maintain major open source projects and contribute a lot to other projects. I don’t think that means everything we do has to be open source. Sorry this one wasn’t. Doing this in pure open source would be a book, not a blog post.
Love Let’s Encrypt — we’re sponsors — but using them for WiFi is a terrible idea. You need internal PKI for WiFi.
In WPA3 Enterprise 192-bit mode at home