Running one’s own root Certificate Authority in 2023
“Cultural” technical issues are so frustrating to me. A certificate is fundamentally just a type of credential, like a password, but for historical reasons they’re treated like getting citizenship papers. There’s always this <i>ceremony</i> even in scenarios where it makes zero sense — such as internal-use certificates used for a gRPC API server behind a load balancer.<p>Why - for the love of God why - can’t I just obtain a cert like this <i>directly</i> out of a secret store such as an Azure Key Vault!?<p>These things are already full hardware security modules (HSMs) with all of the capabilities required to run just about anything short of a public Root CA and maybe even that too.<p>But no.<p>NO!<p>Script it yourself. Make a root cert, “upload” it, make a cert, sign it, upload it, link it, renew it, re-configure it, and on and on. Oh… you wanted a CRL too? A 1kb file? Ha-ha! No. Make it and host it yourself!!<p>It’s absurd.<p>So many services depend on a simple CA-&gt;cert setup: VPNs, API auth, load balancer back-ends, clusters, etc…<p>But my mark my words: no cloud will have a trivial turnkey solution this decade.<p>This is because running a CA is <i>culturally accepted to be a hard problem</i>. It is! If you’re DigiCert. It isn’t if you’re building a three-server internal use cluster. But the problem is <i>hard</i>, you see? That accepted fact! Everyone knows it! <i>Ceremony is required</i>. We can’t just <i>hand</i>  your sever a 1kb credential file! That would be… unconventional!<p>It’s just not the way things are done, so stop asking.