# Recommended Certificate authority

**URL:** <https://forums.rockylinux.org/t/recommended-certificate-authority/9091>\
**Category:** Infrastructure\
**Created:** [March 5, 2023, 12:04pm UTC](https://forums.rockylinux.org/t/recommended-certificate-authority/9091 "2023-03-05T12:04:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dsexton18](https://avatars.discourse-cdn.com/v4/letter/d/85f322/32.png) [@dsexton18](https://forums.rockylinux.org/u/dsexton18)\
**Post date:** [March 5, 2023, 12:04pm UTC](https://forums.rockylinux.org/t/recommended-certificate-authority/9091/1 "2023-03-05T12:04:11Z")

</div>

Does any have recommendation for a simple and easy to setup Certificate authority? I have tried to setup Step-CA with podman but no luck. There are so many options. I want to setup a CA for my home lab. If you have any tutorial recommendations those are also appreciated.

---

<div class="post-metadata">

**Author:** ![lumarel](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/lumarel/32/909_2.png) [@lumarel](https://forums.rockylinux.org/u/lumarel)\
**Post date:** [March 6, 2023, 6:18am UTC](https://forums.rockylinux.org/t/recommended-certificate-authority/9091/2 "2023-03-06T06:18:13Z")

</div>

The simplest certificate authority is of course just using openssl commands.  
But tbh, we (company, I) stuck to step-ca, it’s pretty straight forward, only visibility is a bit lacking.  
We are using the RPM (which is published on every release in their GH releases) on a DMZed machine, with a PostgreSQL DB, works pretty well for our usecases (mostly ACME enrollment)

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [March 6, 2023, 7:58am UTC](https://forums.rockylinux.org/t/recommended-certificate-authority/9091/3 "2023-03-06T07:58:03Z")

</div>

> [@lumarel](#):
>
> The simplest certificate authority is of course just using openssl commands.

I did use that for “home lab” many EL major versions ago.  
A more recent command was `certutil` (and RHEL has documentation for it).  
The next “level” is to use IPA, which includes CA, DNS, Kerberos, LDAP, etc.

---

<div class="post-metadata">

**Author:** ![felfert](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/felfert/32/2259_2.png) [@felfert](https://forums.rockylinux.org/u/felfert)\
**Post date:** [March 6, 2023, 1:17pm UTC](https://forums.rockylinux.org/t/recommended-certificate-authority/9091/4 "2023-03-06T13:17:08Z")

</div>

I don’t know about podman, but with OpenVPN, I usually use easy-rsa (which is part or the OpenVPN project). easy-rsa is available on epel.

---

<div class="post-metadata">

**Author:** ![brian](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/brian/32/5777_2.png) [@brian](https://forums.rockylinux.org/u/brian)\
**Post date:** [August 25, 2023, 3:22am UTC](https://forums.rockylinux.org/t/recommended-certificate-authority/9091/5 "2023-08-25T03:22:51Z")

</div>