<story><title>Running one’s own root Certificate Authority in 2023</title><url>https://wejn.org/2023/09/running-ones-own-root-certificate-authority-in-2023/</url></story><parent_chain><item><author>obnauticus</author><text>I eventually need to publish an article about how to run an HSM backed root CA on the cheap with m of n auth.&lt;p&gt;Using nitrokey and some glue scripts you can get the cost below $500. If anyone is interested, let me know.</text></item></parent_chain><comment><author>dmayle</author><text>I&amp;#x27;ve just started down that route.  I&amp;#x27;ve got the nitro key hsm2 in the mail, have heard the advice on using two levels (first root in the Key, and intermediary on the Device for easier revoking).  I mainly want to issue client certificates so that I can expose internal sites on the public Internet via proxy without having to require a VPN for all of my users, though I&amp;#x27;m also interested in certificate based SSH</text></comment>
<story><title>Running one’s own root Certificate Authority in 2023</title><url>https://wejn.org/2023/09/running-ones-own-root-certificate-authority-in-2023/</url></story><parent_chain><item><author>obnauticus</author><text>I eventually need to publish an article about how to run an HSM backed root CA on the cheap with m of n auth.&lt;p&gt;Using nitrokey and some glue scripts you can get the cost below $500. If anyone is interested, let me know.</text></item></parent_chain><comment><author>n0n</author><text>Yes, please! I would be interested. Currently i&amp;#x27;m fiddling around with vault as an ICA, so this sounds like a good next step</text></comment>